chore(ci): add explicit GITHUB_TOKEN permissions to workflows

[ilhan007]

Summary

• Adds explicit permissions blocks to all workflows that will be affected by the upcoming read-only default GITHUB_TOKEN enforcement (May 27, 2026).
• Each workflow declares the minimum required permissions following the principle of least privilege.
• Removes the legacy release-downport.yaml workflow, which is superseded by the v1 job in release.yaml.

Permissions applied

Workflow	Permission	Reason
ci-test.yaml	contents: read	Read-only CI (checkout, build, test)
ci-test-website.yaml	contents: read	Read-only CI (checkout, build, typecheck)
lint.yaml	contents: read	Read-only CI (checkout, lint)
deploy-preview.yaml	contents: read	Writes use PAT (UI5_WEBCOMP_BOT_GH_TOKEN)
deploy.yaml	contents: write	Pushes to gh-pages via GITHUB_TOKEN
issue-close.yaml	issues: write	actions/stale labels/closes issues
issue-comment.yaml	issues: write	Comments on closed issues
issue-reopen.yaml	issues: write	Reopens issues on comment
reset-gh-pages.yaml	contents: read	Force-push uses PAT
reset-preview-deploy.yaml	contents: read	Netlify deploy + PR comments use PAT

Removed

• release-downport.yaml — superseded by the v1 job in release.yaml (same flow: conventional-graduate + publish with dist-tag)

Test plan

• Verify CI workflows (test, website, lint) pass on this PR
• Confirm no permission errors in workflow runs