Add explicit permissions to workflow and update action versions

[mbg]

The CI workflow was no longer functional and contained a number of issues, which this PR addresses:

• Adds explicit permissions, so that the workflow does not have the overly permissive legacy permissions
• Updates the versions of the actions used
• Newer versions of setup-go implement dependency caching themselves, so we don't have to do this ourselves
• The workflow triggers meant that the workflow ran twice for PRs. The changes there should mean that the workflow only triggers for the pull_request event on PRs.

[Copilot]

Pull Request Overview

A concise update to the CI workflow configuration to add explicit repository content permissions.

• Adds explicit explicit permissions for the workflow by specifying repository contents have read access.

Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more

[smowton]

Suggest note in the title/description that you also upgrade actions and remove explicit cache ops presumably due to replacement by setup-go. Otherwise lgtm.