ci: restrict ci workflow permissions to read-only

[arpitjain099]

Each of these workflows runs without a top-level permissions: block, so its GITHUB_TOKEN inherits the repository (or org) default, which is frequently read/write for all scopes.

Setting contents: read explicitly on .github/workflows/ci.yml keeps the workflow token scoped to what the job actually uses. If a third-party action or transitive dependency in the run were ever compromised, a read-only token limits the damage (no pushes, no releases, no token-backed writes). The change is mechanical and does not alter any step.

[cla-bot]

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

[arpitjain099]

@hashhar @nineinchnick could one of you re-run the CLA check here when you get a chance?

I signed the Trino Foundation individual CLA some months ago, and it is on file: the same verification/cla-signed check passes on my PR in trino-python-client, trinodb/trino-python-client#624. This PR predates the signature, so the bot here is still showing the result from before and has not rechecked since.

No rush on reviewing the change itself, I just did not want the stale check to be the reason it sits.

[nineinchnick]

@cla-bot check

[cla-bot]

The cla-bot has been summoned, and re-checked this pull request!