CI: harden GitHub Actions token permissions (#2206)