ci: Add explicit permissions to workflows

[Mrtenz]

This fixes a bunch of CodeQL alerts.

---

Note

Low Risk
CI-only change that narrows workflow token permissions; main risk is unexpected permission-related failures if a step implicitly relied on broader defaults.

Overview
Sets explicit default permissions on the reusable workflows (build-lint-test.yml, publish-release.yml) and the main.yml workflow to contents: read to satisfy security tooling and follow least-privilege defaults.

Further restricts the main.yml aggregation jobs (all-jobs-completed, all-jobs-pass) by explicitly setting permissions: {} so they run with no GITHUB_TOKEN access.

^{Reviewed by Cursor Bugbot for commit 5ef8fa0. Bugbot is set up for automated code reviews on this repo. Configure here.}