ci: Restrict content permissions to harden GitHub Actions

[matthewfeickert]

Description

• Restrict content permissions to read. At the moment there are no steps to the changed workflows that use tokens, and so this is preventative if this ever changes.
• Give packages write permissions to publish to ghcr.
  • Amends PR [StepSecurity] ci: Restrict token permissions to harden GitHub Actions #2483.

Checklist Before Requesting Reviewer

• Tests are passing
• "WIP" removed from the title of the pull request
• Selected an Assignee for the PR to be responsible for the log summary

Before Merging

For the PR Assignees:

• Summarize commit messages into a comprehensive review of the PR

* Restrict content permissions to read. At the moment there are no
  steps to the changed workflows that use tokens, and so this is
  preventative if this ever changes.
* Give packages write permissions to publish to ghcr.
   - Amends PR https://github.com/scikit-hep/pyhf/pull/2483.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.21%. Comparing base (cdd404a) to head (2c7cd3f).
Report is 22 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2484   +/-   ##
=======================================
  Coverage   98.21%   98.21%           
=======================================
  Files          69       69           
  Lines        4543     4543           
  Branches      804      804           
=======================================
  Hits         4462     4462           
  Misses         48       48           
  Partials       33       33           

Flag	Coverage Δ
contrib	97.79% <ø> (ø)
doctest	98.08% <ø> (ø)
unittests-3.10	96.23% <ø> (ø)
unittests-3.11	96.23% <ø> (ø)
unittests-3.12	96.23% <ø> (ø)
unittests-3.8	96.25% <ø> (ø)
unittests-3.9	96.27% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[matthewfeickert]

Need to give packages write permissions as PR #2483 failed on pushing to the registry with

ERROR: failed to solve: failed to push ghcr.io/scikit-hep/pyhf:latest: unexpected status from POST request to https://ghcr.io/v2/scikit-hep/pyhf/blobs/uploads/: 403 Forbidden

and https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-actions shows that requires write to POST.