ci: set explicit workflow permissions to read (should be a no-op) (#5318)

* We're using restricted GITHUB_TOKENS by default.
* This is expected to be a no-op operation for codeql.

.github/workflows/run_notebooks.yml

@@ -11,6 +11,9 @@ on:
   schedule:
     - cron: "0 13 * * *"
 
+permissions:
+  contents: read
+
 defaults:
   run:
     working-directory: docs