Add scoped permissions: blocks to workflows missing them

## Summary
Several workflows in this repo do not declare a `permissions:` block, which means jobs run with the repo's default `GITHUB_TOKEN` scopes. Scoping permissions per-workflow (or per-job) limits damage if any third-party action is compromised.

## Workflows to review and tighten
- `specification-github-pages.yaml`
- `test-rust.yaml`
- `grafana-dashboard-preview.yaml`
- (sweep the rest with `grep -L "^permissions:" .github/workflows/*.yaml`)

## Suggested approach
For each workflow, audit what the steps actually need (read code, write packages, push to gh-pages, etc.) and add a top-level `permissions:` block with the minimum required scopes, e.g.:

```yaml
permissions:
contents: read
packages: write # only if pushing to GHCR
pull-requests: write # only if commenting on PRs
```

## Context
Surfaced during a security audit. This is a defense-in-depth recommendation — particularly relevant because every workflow here is reused across the entire org, so a tightened default is widely beneficial.