ci: update token permission, only give `contents: read` #18496

Job	Run time
test-node (24.2.0, ubuntu-latest)	17s
wasm (crypto/_wasm)	8s
lint (ubuntu-latest)	24s
lint (windows-latest)	58s
test-bun (latest, ubuntu-latest)	11s
test (v1.x, ubuntu-latest)	2m 6s
test (v1.x, macOS-latest)	2m 57s
test (canary, windows-latest)	6m 49s
test (v1.x, windows-latest)	2m 32s
test (v2.x, windows-latest)	5m 6s
test (canary, ubuntu-latest)	4m 45s
test (canary, macOS-latest)	6m 3s
test (v2.x, ubuntu-latest)	3m 24s
test (v2.x, macOS-latest)	3m 4s
	38m 44s

Provide feedback