Add explicit permissions to CI/CD workflows for secure PR operations (#46)