fix: restrict top-level workflow token permissions to read-only

[BjoernKarma]

Summary

• Move write permissions from top-level to job-level in ci.yaml, release.yaml, reusable-go-ci.yaml, and codeql.yml
• Ensures the GITHUB_TOKEN follows least-privilege by only granting write access where jobs actually need it
• Resolves OpenSSF Scorecard Token-Permissions alerts (feat: Add lipgloss and convert output as a tree #9, feat(actions): Use golangci-lint version v2.1 #18-23)

Details

Workflow	Change
ci.yaml	Top-level restricted to contents: read; write perms moved to gitctl job
release.yaml	Top-level restricted to contents: read; write perms moved to release job
reusable-go-ci.yaml	Added top-level contents: read; added job-level perms for tests, codeql, and build jobs
codeql.yml	Added top-level contents: read (job already had proper permissions)

Note: Alert #1 (go.yml) references a file that no longer exists and should auto-dismiss or be manually closed.

Test plan

• CI workflow passes on this PR (validates permissions are sufficient)
• Verify Scorecard re-scan resolves Token-Permissions alerts