Set up permissions for Github Workflows

**If you are reporting *any* crash or *any* potential security issue, *do not*
open an issue in this repo. Please report the issue via emailing
envoy-security@googlegroups.com where the issue will be triaged appropriately.**

*Title*: *Set up permissions for Github Workflows*

*Description*:
Hi, I 'm from Google working with the OpenSSF to help open source projects to increase their supply-chain security.

I would like to suggest to set the GITHUB_TOKEN permissions of your workflows as read only in the [top level](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions) and grant any write permission needed at the [run level](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idpermissions).

It is a default behavior of github workflows to grant write permissions to all permissions, thus it is both a recommendation from OpenSSF Scorecard and the Github to always use credentials that are minimally scoped.

If a PR is welcome with the changes, let me know.

[optional *Relevant Links*:]
- [OpenSSF Scorecard Token Permission Check](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions)
- [Github Security Recommendations](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)