Move the organization from permissive to restricted

## Motivation

The DIRACGrid organization still uses the **permissive** default for the automatic `GITHUB_TOKEN` in GitHub Actions: every workflow run gets **read/write** access to almost all scopes of its repository, and workflows are allowed to approve pull requests. If any workflow is compromised (malicious dependency, script injection via PR title/branch name, compromised third-party action), the ambient token can push commits, tamper with releases, or approve PRs.

Switching the organization default to **restricted** (`contents: read`, `packages: read`) limits the blast radius, and forces the few workflows that genuinely need write access to declare it explicitly via a `permissions:` block, making privileges reviewable in the diff.

**Terminology** — "permissive"/"restricted" is the wording used in GitHub's docs; the UI and API use different labels for the same two options:

| Docs term | UI label (Settings → Actions → General → Workflow permissions) | API value (`default_workflow_permissions`) |
|------------|------------------------------------------------------------------|--------------------------------------------|
| permissive | Read and write permissions | `write` |
| restricted | Read repository contents and packages permissions | `read` |

Docs: [Setting the default `GITHUB_TOKEN` permissions at org level](https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization) · [Use `GITHUB_TOKEN` for authentication in workflows](https://docs.github.com/en/actions/tutorials/authenticate-with-github_token)

## DoD

- [ ] Audit workflows in the other repositories and add explicit `permissions:` blocks where write access is needed (pushing commits/tags, publishing packages/releases, `gh-pages`, PR/issue comments, check runs, `security-events` for CodeQL/Trivy uploads):
- [ ] DIRAC
- [ ] diracx-web
- [ ] diracx-charts
- [ ] Pilot
- [ ] management
- [ ] (any other repo with Actions enabled)
- [ ] An org admin flips the org setting: **Settings → Actions → General → Workflow permissions → "Read repository contents and packages permissions"**, and decides whether to keep **"Allow GitHub Actions to create and approve pull requests"** enabled (only needed by workflows that create/approve PRs with `GITHUB_TOKEN`; workflows using a PAT or GitHub App token are unaffected).

- [ ] Watch the first scheduled/release/deployment runs after the flip for permission failures (`Resource not accessible by integration`).

Note: once the org default is restricted, the permissive option disappears from repo-level settings, but workflows can still request write scopes explicitly through their `permissions:` key, which is the intended mechanism.