ci: restrict default GITHUB_TOKEN permissions to contents: read

None of these workflows write through GITHUB_TOKEN: artifact upload,
Firebase, S3, Play Store, gh-pages and the Appium dispatch all use their
own credentials. Reusable workflows they call inherit the same cap.

.github/workflows/balances_test.yml

@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '0 */8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   build-app:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main