Modify the default permissions granted to `GITHUB_TOKEN` for a job

From https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

name: "My workflow"

on: [ push ]

permissions:
  actions: read|write|none
  checks: read|write|none
  contents: read|write|none
  deployments: read|write|none
  id-token: read|write|none
  issues: read|write|none
  discussions: read|write|none
  packages: read|write|none
  pages: read|write|none
  pull-requests: read|write|none
  repository-projects: read|write|none
  security-events: read|write|none
  statuses: read|write|none

jobs:

Example:

jobs:
  stale:
    runs-on: ubuntu-latest

    permissions:
      issues: write
      pull-requests: write

    steps:
      - uses: actions/stale@v5

Read the linked GitHub Actions permissions documentation and the YAML workflow example, then determine which default GITHUB_TOKEN permissions should change and where this repository represents that behavior. Done requires an agreed, testable definition of the new defaults; the issue does not name a repository file or test to update.