ci: declare minimal permissions for Actions

[chenjiahan]

Summary

Declare minimal permissions for GitHub Actions, and remove some unused GITHUB_TOKEN.

Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token

Checklist

• Tests updated (or not required).
• Documentation updated (or not required).

[netlify]

✅ Deploy Preview for rspack canceled.

Name	Link
🔨 Latest commit	0ec68ad
🔍 Latest deploy log	https://app.netlify.com/sites/rspack/deploys/6788baa0e3353800083cfa27

[codspeed-hq]

CodSpeed Performance Report

Merging #9018 will not alter performance

_{Comparing ci_permissions_0116 (0ec68ad) with main (54ddde8)}

Summary

✅ 3 untouched benchmarks