drop unnecessary actions:write and contents:write permissions

Tested on aconite33/cla-workflow-test with only pull-requests:write
and statuses:write -- both human CLA and bot skip paths work correctly.
The CLA assistant uses PERSONAL_ACCESS_TOKEN (app token) for writing
signatures to the remote CLA repo, not GITHUB_TOKEN.

Author: aconite33

.github/workflows/cla.yml

@@ -6,8 +6,6 @@ on:
     types: [opened, closed, synchronize]
 
 permissions:
-  actions: write
-  contents: write
   pull-requests: write
   statuses: write