ci: set default permissions for workflows

The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions

.github/workflows/response.yml

@@ -5,6 +5,8 @@ on:
   workflow_dispatch:
   issue_comment:
 
+permissions: {}
+
 jobs:
   close:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'