ci: restrict default GITHUB_TOKEN permissions to contents: read

None of these workflows write through GITHUB_TOKEN: artifact upload,
Firebase, S3, Play Store, gh-pages and the Appium dispatch all use their
own credentials. Reusable workflows they call inherit the same cap.

.github/workflows/appium-mobile-tests.yml

@@ -34,6 +34,9 @@ env:
   ALLURE_ENDPOINT: https://pezkuwi.testops.cloud/
   ALLURE_PROJECT_ID: 103
 
+permissions:
+  contents: read
+
 jobs:
   trigger-tests:
     runs-on: ubuntu-latest