ci: set least-privilege token permissions on core CI workflows

[rivassec]

Adds a top-level permissions: contents: read to core CI workflows that currently rely on the default GITHUB_TOKEN scope: unit-test.yml, ci-pull_request.yml, packaging.yml (PR/merge_group builds only, no push), and ci.yml.

ci.yml keeps all its existing job-level permissions: blocks (OIDC id-token: write, pull-requests: write) — those override the top-level default, so only the previously-unscoped jobs are tightened. eks-ci.yml is intentionally left out (it writes back to the PR and pushes images).

No behavior change; hardening only.

[mergify]

This pull request does not have a backport label. Could you fix it @rivassec? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[cla-checker-service]

💚 CLA has been signed

[rivassec]

This pull request does not have a backport label. Could you fix it @rivassec? 🙏 To fixup this pull request, you need to add the backport labels for the needed branches, such as:

* `backport-v./d./d./d` is the label to automatically backport to the `8./d` branch. `/d` is the digit

* `backport-active-all` is the label that automatically backports to all active branches.

* `backport-active-8` is the label that automatically backports to all active minor branches for the 8 major.

* `backport-active-9` is the label that automatically backports to all active minor branches for the 9 major.

I do not have the ability of assign labels