[meta] GH: default token permissions?

(from https://github.com/haskell/cabal/pull/10331/files#r1748758142 ff.)

I should note that, if the default token _does_ in fact have permissions to make releases, what other permissions does it have that might be problematic with respect to random composite actions? Does someone need to audit the actions we use regularly to make sure they're safe? The actual (as opposed to documented) permissions structure seems to lean a bit too far toward convenience over security.

(Background: GitHub Actions documentation claims that "actions" (formally "composite actions" per GHA docs) ~~don't have access to the workflow's token, but it appears that in fact they do~~. (In fact, I just read through it again, and it's talking about _secrets_, which are a different feature that [we don't use](https://github.com/haskell/cabal/settings/secrets/actions) and don't include the workflow's tokens. Which leaves open the question of token security.) The default token also apparently has sufficient permissions to make releases, again contrary to documentation including the [documentation](https://github.com/softprops/action-gh-release/blob/v2/README.md#permissions) for the auto-release action we are using, which asserts that we need to grant the workflow token `permissions: write`. From a security standpoint, this is worrisome.)

Start with the permissions question raised from PR 10331, then compare GitHub Actions documentation with the softprops/action-gh-release permissions guidance. Review the repository's workflows and composite actions to establish the effective token permissions and identify the required audit or configuration changes; done means the security concern has a concrete, agreed resolution.

Written by the indexing model from the issue text.