ci: give every workflow a least-privilege GITHUB_TOKEN - #918

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/gradle-build-tools-actions/dependency-submission@8379f6a1328ee0e06e2bb424dadb7b159856a326. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Submitted dependency-graph-reports/dynamicdependency-graphauto-submission-submit-gradle.json: The snapshot was accepted, but it is not for the default branch. It will not update dependency results for the repository.