Add explicit permissions to 10 GitHub Actions workflows

## Recommendation

### ⚙️ Add Least-Privilege Permissions

10 workflows lack explicit `permissions:` declarations. Without them, workflows get the repo's default token permissions (often broader than needed).

## Affected Workflows

- `ci-json-validation.yaml`
- `ci-python-validation.yaml`
- `ci-shell-validation.yaml`
- `ci-tests-unit.yaml`
- `ci-yaml-validation.yaml`
- `i18n-update-core.yaml`
- `i18n-update-custom-nodes.yaml`
- `i18n-update-nodes.yaml`
- `release-biweekly-comfyui.yaml`
- `release-pypi-dev.yaml`

## How to Fix

Add minimal permissions at the workflow level:
```yaml
permissions:
contents: read
```

For workflows that need write access (i18n-update, release), specify only what's needed:
```yaml
permissions:
contents: write
pull-requests: write
```

---
**Category:** CI/CD Security | **Priority:** Recommended | **Effort:** Trivial
Part of #11022
_Filed by repo-audit skill_

┆Issue is synchronized with this [Notion page](https://www.notion.so/Issue-11026-Add-explicit-permissions-to-10-GitHub-Actions-workflows-33e6d73d365081258bfff4ba89652234) by [Unito](https://www.unito.io)

Open the ten named GitHub Actions workflow files and inspect each job's repository and pull-request operations before choosing its minimum token permissions. Add explicit workflow-level permissions, then run the relevant validation workflows or CI checks. Done means all ten workflows declare only the access they require and continue to pass.

Written by the indexing model from the issue text.