#3746 ci: limit the default token permissions in release and scorecards

The release and scorecards workflows set permissions: read-all at the workflow level. This gives read access to all scopes to each job that does not set its own permissions. The ci-pipeline-security policy reports this as excessive-permissions (zizmor).

This change sets the workflow-level permissions to contents: read in both workflows. The jobs that need more access already set their permissions at the job level. The reusable workflows that these files call (test.yml, chainloop_init and chainloop_push) need only contents: read.

Refs PFM-8051.

AI disclosure: Claude Code helped to write this change.