Improve OSSF Scorecard Token-Permissions check by tightening GitHub Actions permissions

```
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"details": [
"Warn: jobLevel 'actions' permission set to 'write': .github/workflows/pr-auto-fix.yaml:7",
"Warn: jobLevel 'contents' permission set to 'write': .github/workflows/pr-auto-fix.yaml:8",
"Info: jobLevel 'contents' permission set to 'read': .github/workflows/pr-auto-tag.yaml:11",
"Warn: jobLevel 'contents' permission set to 'write': .github/workflows/publish-to-bcr.yaml:35",
"Info: found token with 'none' permissions: .github/workflows/pr-auto-fix.yaml:1",
"Info: topLevel 'contents' permission set to 'read': .github/workflows/pr-auto-tag.yaml:6",
"Warn: no topLevel permission defined: .github/workflows/pr-check-bzlmod-deps.yaml:1",
"Warn: no topLevel permission defined: .github/workflows/publish-to-bcr.yaml:1",
"Warn: topLevel 'contents' permission set to 'write': .github/workflows/update-artifacts-branch.yaml:9"
],
}
```

Several top level permissions are missing, as a result of which the score is low for this particular check of the OpenSSF scorecard. This score can go to 10 if all the top level permissions are set to `content: read` (i.e, minimal permissions at the top level)

More details on this check:
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions