ci: drop default workflow-level permissions

Add a top-level permissions: {} so the GITHUB_TOKEN is granted no scopes
by default; the job continues to declare only the contents/deployments/
pull-requests scopes it actually needs. Identified by a routine workflow
security audit.

Author: emptyhammond

.github/workflows/review-app.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [labeled, unlabeled, closed]
 
+permissions: {}
+
 jobs:
   manage-review-app:
     runs-on: ubuntu-latest