[WIP] Add minimum token permissions for all github workflow files

[Copilot]

Thanks for assigning this issue to me. I'm starting to work on it and will keep this PR's description up to date as I form a plan and make progress.

Original issue description:

see https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#token-permissions

notes:

• use permissions: contents: read instead of permissions: read-all
• for job-specific permission blocks, always place them at the top of the job
• don't make any changes to ossf-scorecard.yml
• remember elevated token permissions for a specific step aren't needed when OPENTELEMETRYBOT_GITHUB_TOKEN is used for that step
• remember actions/cache/save doesn't use GITHUB_TOKEN

related to https://scorecard.dev/viewer/?uri=github.com/open-telemetry/opentelemetry-js

Fixes #1.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.