chore: restrict CI job permissions

Author: oetr

.github/workflows/run-all-tests-pr.yaml

@@ -4,6 +4,10 @@ on:
     branches: [main]
   merge_group:
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 concurrency:
   group:
     ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}