Backport workflow-hardening fix (excessive-permissions) to 5 release branches

### Summary
The default branch already hardened `.github/workflows/protected-files.yaml` against the issue(s) below, but **5** release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

### What's flagged (by [zizmor](https://github.com/woodruffw/zizmor))
- `excessive-permissions` — workflow/job granted broader `permissions` than needed

Already resolved on the default branch in:
- https://github.com/azure/azure-rest-api-specs/commit/3682aa5a72ec0d25167b6b6555946ca63fc83231

### Affected release branches (5)
- **`release-devcenter-Microsoft.DevCenter-2025-02-01`** (still present as of HEAD `508a12f0`)
- **`release-mongo-cluster-2025-02-01-preview`** (still present as of HEAD `65ce57ee`)
- **`release-machinelearningservices-Microsoft.MachineLearningServices-2025-01-01-preview`** (still present as of HEAD `10fe6e07`)
- **`release-storage-storagedatarp-2024-11-01-preview`** (still present as of HEAD `95aa73b8`)
- **`release-keyvault-Microsoft.KeyVault/7.6-preview.2`** (still present as of HEAD `f1dd982b`)

### Suggested per-branch patches
Each diff below was checked locally with **zizmor** and **actionlint**: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-devcenter-Microsoft.DevCenter-2025-02-01 — excessive-permissions

File `.github/workflows/protected-files.yaml`; suggested edits:
- + permissions.contents = 'read'

```diff
--- a/.github/workflows/protected-files.yaml
+++ b/.github/workflows/protected-files.yaml
@@ -44,3 +44,5 @@
Write-Output "No changes to protected files: [$($protectedFiles -join ', ')]"
}
shell: pwsh
+permissions:
+ contents: read
```

release-mongo-cluster-2025-02-01-preview — excessive-permissions

File `.github/workflows/protected-files.yaml`; suggested edits:
- + permissions.contents = 'read'

```diff
--- a/.github/workflows/protected-files.yaml
+++ b/.github/workflows/protected-files.yaml
@@ -44,3 +44,5 @@
Write-Output "No changes to protected files: [$($protectedFiles -join ', ')]"
}
shell: pwsh
+permissions:
+ contents: read
```

release-machinelearningservices-Microsoft.MachineLearningServices-2025-01-01-preview — excessive-permissions

File `.github/workflows/protected-files.yaml`; suggested edits:
- + permissions.contents = 'read'

```diff
--- a/.github/workflows/protected-files.yaml
+++ b/.github/workflows/protected-files.yaml
@@ -43,3 +43,5 @@
Write-Output "No changes to protected files: [$($protectedFiles -join ', ')]"
}
shell: pwsh
+permissions:
+ contents: read
```

release-storage-storagedatarp-2024-11-01-preview — excessive-permissions

File `.github/workflows/protected-files.yaml`; suggested edits:
- + permissions.contents = 'read'

```diff
--- a/.github/workflows/protected-files.yaml
+++ b/.github/workflows/protected-files.yaml
@@ -43,3 +43,5 @@
Write-Output "No changes to protected files: [$($protectedFiles -join ', ')]"
}
shell: pwsh
+permissions:
+ contents: read
```

release-keyvault-Microsoft.KeyVault/7.6-preview.2 — excessive-permissions

File `.github/workflows/protected-files.yaml`; suggested edits:
- + permissions.contents = 'read'

```diff
--- a/.github/workflows/protected-files.yaml
+++ b/.github/workflows/protected-files.yaml
@@ -40,3 +40,5 @@
Write-Output "No changes to protected files: [$($protectedFiles -join ', ')]"
}
shell: pwsh
+permissions:
+ contents: read
```

---
*Happy to open pull requests instead if that's preferred.*

Update .github/workflows/protected-files.yaml on each of the five listed release branches, using the resolved default-branch commit as the reference. Start by comparing each branch's workflow with that commit, then run zizmor and actionlint on the affected workflows. Done means each excessive-permissions finding is cleared without new lint or security findings.

Written by the indexing model from the issue text.