ci: set default permissions for workflows

The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions

.github/workflows/docs.yml

@@ -2,6 +2,9 @@ name: docs
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
+
+permissions: {}
+
 jobs:
   docs:
     runs-on: ubuntu-latest