Check affect of changing default workflow permissions to match GitHub's security recommendations

### Overview
We need to change the permissions for the default `GITHUB_TOKEN` from read/write to read only per [GitHub's recommendation for security best practice](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token).

### Details
Before proceeding, [read the explainer below](https://github.com/hackforla/website/issues/8178#issuecomment-3314503242).

We need to audit each of our workflows to identify exactly what permissions are needed at each level of the workflow, i.e. overall, job-level, and step-level.
This issue has three objectives:
- First, we will reduce the permissions of the default `GITHUB_TOKEN`.
- At the top level of each workflow's YAML explicitly state the default token's permissions:
```yml
# Set defaults for GITHUB_TOKEN
permissions:
contents: read
issues: read
```
- Next, we will analyze and test each workflow to check whether additional permissions are required **_at the step-level_** to ensure each workflow functions as expected, and note whether the permission requires a PAT.
- This information will be itemized on a spreadsheet for each step of each workflow.
- see additional comments and "Permissions audit" following
### TODO
- [ ] after completion of all, reduce default permissions at bottom of https://github.com/hackforla/website/settings/actions
- [ ] three action items from Security audit
- [ ] admin:org_hook on HACKFORLA_BOT_PA_TOKEN and HACKFORLA_ADMIN_TOKEN — No workflow creates, updates, or deletes webhooks. This scope appears unused on both tokens and can likely be removed after testing.
- [ ] repo vs public_repo on HACKFORLA_GRAPHQL_TOKEN — repo grants full access including private repos. If all targeted repos are public, this could be narrowed to public_repo. Requires testing to confirm no operation depends on the broader scope.
- [ ] pr-verification.yml — pull_request_target without a repository guard — This is the only pull_request_target workflow and has no if: github.repository == 'hackforla/website' guard. Practical risk is low (HACKFORLA_ADMIN_TOKEN is not available in fork secret stores), but the pattern is inconsistent with other workflows.

### Action Items

- [x] #8323
- [x] #8336
- [x] #8576
- [x] #8579
- [x] #8580
- [ ] #8581
- [x] #8582
- [x] #8583
- [x] #8584
- [x] #8585
- [ ] #8586
- [x] #8587
- [ ] #8588
- [ ] #8589
- [ ] #8590
- [x] #8591
- [ ] #8592

### Resources/Instructions
- [Additional Notes for GitHub Actions](https://docs.google.com/document/d/1frtvr5twBa_3yRGCG0divhlOMW8dPJxT/edit)
- [Tokens, Secrets, Scopes, & Permissions](https://github.com/hackforla/website/issues/8178#issuecomment-3314503242)
- [GitHub Automatic token authentication](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
- Initiated by #6649