ci: declare least-privilege workflow permissions

Jobs without a permissions block inherit the repository default token
scope. Scopes are derived from what each workflow actually does with
the token:

- the fourteen package build and test workflows plus the code linter
  never write through the token, they drop to contents: read.
- lint-pr-title.yml gets pull-requests: read, which is what the
  semantic PR title action documents needing.
- comment-icon-preview.yml runs on workflow_run, a privileged trigger
  processing artifacts produced by fork PRs, so an exact scope matters
  most there: actions: read to download the artifact, issues: write
  plus pull-requests: write to post the preview comment, contents:
  read for the rest.

The workflows that already declared scoped permissions (labeler,
stale, linting-icons, release and friends) are untouched.

.github/workflows/angular.yml

@@ -7,6 +7,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest