TPT-3778: Add explicit GitHub Actions permissions

[zliang-akamai]

📝 Description

Add explicit least-privilege GITHUB_TOKEN permissions to the build, labeler, and release workflows.

This addresses code scanning alerts 1 through 4 for actions/missing-workflow-permissions. Read-only CI receives contents: read, label synchronization receives contents: read and issues: write, and GoReleaser receives contents: write to publish release assets.

[Copilot]

Pull request overview

This pull request adds explicit, least-privilege GITHUB_TOKEN permissions to the repository’s GitHub Actions workflows to satisfy actions/missing-workflow-permissions code scanning alerts and reduce default token scope.

Changes:

• Set permissions: contents: read for the build/test CI workflow.
• Set permissions: contents: read and issues: write for the label synchronization workflow.
• Set permissions: contents: write for the GoReleaser workflow that publishes release assets.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/build-test.yml	Restricts CI token to read-only repository contents.
.github/workflows/labeler.yml	Grants minimal rights needed to sync labels (issues: write) plus read access to repo contents.
.github/workflows/release.yml	Grants contents: write required for release publication/upload steps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.