Add global permissions

[etspaceman]

See sbt/sbt-github-actions#105

[armanbilge]

Just a couple nits but looks good to go. I like how this turned out!

Note for posterity: we had some discussion on Discord about whether to explicitly set permissions for the build, publish, site, etc. jobs. The tricky thing is it's hard to know exactly what permissions are required, particularly if the user has added some custom workflow steps. It's a bit annoying because as soon as we specify a few permissions for the things we know we need, we have to specify all the permissions with no way of falling back to the defaults that the user has set in their repository settings. So it's not very compositional.

I'm not entirely convinced how much security benefit it would bring either. So I think opt-in is okay for now, and we can revisit in the future.

[etspaceman]

@armanbilge did one more optimization by moving the string rendering to the Permissions classes. If you don't like that approach, no worries, we can revert the commit.

[armanbilge]

If you don't like that approach, no worries, we can revert the commit.

Oh yeah, maybe just leave it the way it was. It was fine and I think following the existing style of the project.

[etspaceman]

Reverted

[armanbilge]

thanks!