chore(ci): add top-level permissions: read-all to rust-ci + language-policy

Resolves Hypatia workflow_audit findings (missing_permissions, medium):
* rust-ci.yml
* language-policy.yml

Hardening companion to 1ca4fa0 (SHA pinning). rescript-deno-ci.yml was
already addressed by b93e0ea (reusable-workflow wrapper).

https://claude.ai/code/session_01MC3HDKEwGgcRwCuUuRmEeP

Author: claude

.github/workflows/language-policy.yml

@@ -1,6 +1,9 @@
 # SPDX-License-Identifier: MPL-2.0-or-later
 name: Language Policy Enforcement
 on: [push, pull_request]
+
+permissions: read-all
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/rust-ci.yml

@@ -1,6 +1,9 @@
 # SPDX-License-Identifier: MPL-2.0-or-later
 name: Rust CI
 on: [push, pull_request]
+
+permissions: read-all
+
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: -Dwarnings