fix: restrict GitHub Actions workflow token permissions (OSSF least-privilege)

[Copilot]

OSSF Scorecard flagged four workflows with no top-level permissions block, meaning jobs inherit potentially broad default token permissions rather than the minimum required.

Changes

• codeql.yml — Added top-level permissions: {}. Job-level scoped permissions (actions: read, contents: read, security-events: write) were already correct.
• release.yml — Added top-level permissions: {}. Job-level scoped permissions (contents: write, id-token: write) were already correct.
• snap-release.yml — Added top-level permissions: {} and explicit job-level contents: read. Snap publishing uses the STORE_LOGIN secret, not GITHUB_TOKEN.
• docker-release.yml — Added top-level permissions: {} and job-level contents: read + packages: write. packages: write is required for pushing to ghcr.io via GITHUB_TOKEN.

test-yq.yml and go.yml already had permissions: contents: read at the top level and were not changed.

permissions: {}   # top-level: deny all by default

jobs:
  publishDocker:
    permissions:
      contents: read   # checkout only
      packages: write  # push to ghcr.io