ci: set explicit workflow permissions to read (should be a no-op) (#5318)

* We're using restricted GITHUB_TOKENS by default.
* This is expected to be a no-op operation for codeql.

.github/workflows/_lint.yml

@@ -8,6 +8,9 @@ on:
         type: string
         description: "From which folder this pipeline executes"
 
+permissions:
+  contents: read
+
 env:
   # This env var allows us to get inline annotations when ruff has complaints.
   RUFF_OUTPUT_FORMAT: github