Add a permissions block for generated workflows

[aeisenberg]

Ensure that all workflows are able to write security events. Fixes a bug where CI jobs were failing during the upload status report request if the ref property of the report was not the same as the PR ref.

I changed the approach in this PR. Instead of adding a permissions block, I am changing how the TEST_MODE environment variable works. Now, when this variable is set, no status reports will be uploaded to code scanning.

The reasoning is that code scans from forks will never be allowed to have security-events: write permissions for resources other than the current PR. This is a conscious decision and meant to prevent third parties from maliciously uploading new code scans for refs they do not control.

See #889

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.