github/workflows: set read-only default permissions to approve workflow

github/workflows: set read-only default permissions to approve workflow #8783