ci: declare least-privilege permissions

none of the three declared any, so each got the repository default.
release.yml and docs.yml already do this. all three only check out,
build, test and upload artifacts.

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/folio.yml

@@ -32,6 +32,9 @@ on:
         description: step budget override (0 = each job's calibrated budget)
         default: "0"
 
+permissions:
+  contents: read
+
 jobs:
   android:
     timeout-minutes: 90

.github/workflows/replay-ui.yml

@@ -19,6 +19,9 @@ on:
         description: step budget for the dogfood run
         default: "80"
 
+permissions:
+  contents: read
+
 jobs:
   dogfood:
     timeout-minutes: 45