[TASK] Set workflows to run with read-only permissions

/kind feature

**Why you need this feature:**

Kubeflow's workflows are running with write-all permissions. This puts the project at risk of supply-chain attacks.

I took a look at all the workflows and none of them seem to require significant permissions.

**Describe the solution you'd like:**

There are two solutions:
- all the workflows can be set with read-only top-level permissions; and/or
- the default workflow token can be set to read-only

I'll send a PR setting top-level permissions for all workflows. If you also/instead want to change the default token:

1. Open the repo settings
2. Go to [Actions > General](https://github.com/kubeflow/kubeflow/settings/actions)
3. Under "Workflow permissions", set them to "Read repository contents and packages permissions"

**Anything else you would like to add:**

My name is Pedro and I work with Google and the [Open Source Security Foundation (OpenSSF)](https://www.openssf.org/) to improve the supply-chain security of the open-source ecosystem.

Inspect all workflow files in the repository and review the permissions currently granted to each workflow. Compare them with the requested read-only repository contents and packages permissions, then verify that the workflows still run successfully with the reduced access.

Written by the indexing model from the issue text.