ci: define explicit workflow permissions

[erolunal]

📣 For new features and bugfixes, please create an issue first  

✔️ Checklist

Please review our Contributor Docs for more details

• Fixes Improve security by defining explicit permissions in node.js workflow #18
• Fixes Improve Node.js CI workflow #14
• I have run npm version [patch, minor, major] (considering (semantic versioning)[https://semver.org/#summary)) for a new release if needed
• If the package version changed, this PR's title is prefixed with release([VERSION]):
• I have added typedoc-style comments to my changes to improve the developer experience

---

⏩ Next steps:

• Please ensure that all the automated pipeline steps pass
• Once your PR is opened, CODEOWNERS will be requested as reviewers. At least one review from a CODEOWNER is required to merge your PR
• Once approved, a CODEOWNER will merge your changes and perform any other necessary release tasks