ci: add explicit permissions to GitHub Actions workflows

[vdusek]

Summary

• Adds explicit permissions blocks to all 8 workflow files, addressing CodeQL "Workflow does not contain permissions" security alerts
• Follows the principle of least privilege: contents: read as the default, with elevated permissions only on jobs that need write access (releases, changelog updates, docs deployment)
• Pre-existing permissions on pypi_publish and _release_docs.yaml jobs are preserved
• Same as ci: add explicit permissions to GitHub Actions workflows apify-client-python#614 and ci: add explicit permissions to GitHub Actions workflows crawlee-python#1792

Test plan

• Verify CI passes on this PR (code checks, tests, doc checks)
• Verify release workflows still work correctly (can be validated on next release)
• Confirm CodeQL alerts are resolved after the next run of CodeQL checks

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.44%. Comparing base (d808305) to head (f8f1a44).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #830      +/-   ##
==========================================
- Coverage   86.47%   86.44%   -0.04%     
==========================================
  Files          48       48              
  Lines        2899     2899              
==========================================
- Hits         2507     2506       -1     
- Misses        392      393       +1     

Flag	Coverage Δ
e2e	38.11% <ø> (ø)
integration	59.57% <ø> (-0.04%)	⬇️
unit	74.40% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.