tighten workflow GITHUB_TOKEN permissions to contents:read

[iicky]

• replace permissions: read-all with permissions: contents: read at the workflow level in ci.yaml, release.yaml, node.yaml, and python.yaml so jobs that don't override get the minimum needed for actions/checkout and nothing else
• add explicit permissions: {} on the test-gate job in ci.yaml — it doesn't check out code or hit any API, so it should hold no token scopes at all
• jobs that need extra scopes (vhs publish, release write, codeql security-events, OIDC publishers) already have their own per-job permissions: blocks and are unaffected