Excessive CI permissions

Most CI workflows do not have any top level permissions defined, and `release-please.yml` sets the top level permission to write instead of setting it on the individual jobs that need those permissions. The actions used by the workflows are not pinned, so this repository is susceptible of a supply chain attack similar to the one that happened to users of `tj-actions/changed-files` in March 2025 (overview of the technical details by some third-party that I have no affiliation with: https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066). Pinning the actions and dropping permissions isn't particularly difficult, do you want me to make a PR for that?