ci: standardize and tighten permissions across reusable workflows

[synackd]

Description

Ensure all reusable workflows follow a consistent permission model:

• Explicit baseline of contents: read at the workflow level
• Job-level overrides for any elevated permissions (e.g., write, packages, id-token, attestations, security-events)

Fix docker-build-release.yml by removing invalid step-level permissions and scoping required rights to the build-push-images job only. This resolves GitHub's validation error when called from workflows that do not grant the full write-all set.

Apply the same discipline to all other workflows, adding explicit permissions and descriptive comments where missing. This enforces least-privilege and makes future audits straightforward.

Fixes failed cloud-init release run: https://github.com/OpenCHAMI/cloud-init/actions/runs/34624459891

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[seantronsen]

🪨