GitHub Workflows security hardening

[sashashura]

This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.
It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.

[codecov-commenter]

Codecov Report

Merging #10518 (7a310c4) into 3.1 (09582dd) will decrease coverage by 0.42%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##                3.1   #10518      +/-   ##
============================================
- Coverage     65.65%   65.22%   -0.43%     
+ Complexity      319      317       -2     
============================================
  Files          1286     1286              
  Lines         55222    55186      -36     
  Branches       8269     8240      -29     
============================================
- Hits          36255    35997     -258     
- Misses        15039    15237     +198     
- Partials       3928     3952      +24     

Impacted Files	Coverage Δ
...mmon/serialize/fastjson2/FastJson2ObjectInput.java	0.00% <0.00%> (-62.50%)	⬇️
...mon/serialize/fastjson2/FastJson2ObjectOutput.java	0.00% <0.00%> (-56.25%)	⬇️
...dubbo/remoting/zookeeper/ZookeeperTransporter.java	50.00% <0.00%> (-33.34%)	⬇️
...on/serialize/fastjson2/FastJson2Serialization.java	57.14% <0.00%> (-28.58%)	⬇️
...ng/zookeeper/curator5/Curator5ZookeeperClient.java	43.86% <0.00%> (-26.42%)	⬇️
...dubbo/common/status/support/LoadStatusChecker.java	41.66% <0.00%> (-25.00%)	⬇️
...nt/metadata/ServiceInstanceHostPortCustomizer.java	65.78% <0.00%> (-21.06%)	⬇️
...n/serialize/fastjson2/Fastjson2CreatorManager.java	46.66% <0.00%> (-20.00%)	⬇️
...ache/dubbo/remoting/transport/AbstractChannel.java	75.00% <0.00%> (-12.50%)	⬇️
...dubbo/remoting/exchange/support/DefaultFuture.java	80.35% <0.00%> (-11.89%)	⬇️
... and 62 more

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more