chore: enforce least-privilege permissions in GitHub Actions workflows

Set top-level `permissions: {}` on all workflows and move required
permissions to job level. Switch publish.yml from secrets.PAT to
secrets.GITHUB_TOKEN so semantic-release can comment on PRs/issues.

.github/workflows/codeql.yml

@@ -11,15 +11,15 @@ on:
     - cron: '30 1 * * 0' # Run at 1:30 AM UTC every Sunday
   merge_group:
 
-permissions:
-  actions: read
-  contents: read
+permissions: {}
 
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
     permissions:
+      actions: read
+      contents: read
       security-events: write
 
     strategy: