chore(actions): address zizmor security findings

Author: g-husam

.github/workflows/java-bigquery-scorecard.yml

@@ -15,7 +15,8 @@ on:
     branches: [ "main" ]
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 env:
   BUILD_SUBDIR: java-bigquery

.github/workflows/java-cloud-bom-release-note-generation.yaml

@@ -28,6 +28,7 @@ jobs:
       with:
         persist-credentials: false
     - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      # zizmor: ignore[cache-poisoning]
       with:
         distribution: temurin
         java-version: 11