ci(sweep): workflow permissions

- Add top-level `permissions: contents: read` to workflows flagged
  by governance-reusable's Workflow security linter.

Author: hyperpolymath

.github/workflows/language-policy.yml

@@ -1,6 +1,9 @@
 # SPDX-License-Identifier: MPL-2.0-or-later
 name: Language Policy Enforcement
 on: [push, pull_request]
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/rescript-deno-ci.yml

@@ -2,6 +2,9 @@
 name: ReScript/Deno CI
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest