Add empty permissions block at workflow level

Caps GITHUB_TOKEN's blast radius. None of these workflows need any
GitHub API write scope — they only push to Docker Hub — so the safest
default is permissions: {}, matching the posture used by AsamK/signal-cli.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -8,6 +8,8 @@ on:
     branches:
       - '**' #every branch
 
+permissions: {}
+
 jobs:
   setup:
     runs-on: ubuntu-24.04

.github/workflows/release-dev-version.yml

@@ -7,6 +7,8 @@ on:
         description: 'Version'
         required: true
 
+permissions: {}
+
 
 jobs:
   setup:

.github/workflows/release-productive-version.yml

@@ -7,6 +7,8 @@ on:
         description: 'Version'
         required: true
 
+permissions: {}
+
 
 jobs:
   setup: