Fix GitHub Actions workflow permissions for private repositories

[Copilot]

Problem

GitHub Actions workflows in this cookiecutter template were failing when used with private repositories due to overly restrictive permissions. All workflows had permissions: {} which prevents actions like checkout from accessing repository contents in private repos.

Solution

Updated all workflow files to include the minimum required permissions for private repository access:

permissions:
  contents: read # needed for checkout in private repos

Changes

• Main repository workflows: Updated tests.yml and zizmor.yml
• Template workflows: Updated tests.yml, lint.yml, docs.yml, release.yml, and zizmor.yml

The fix follows the principle of least privilege by only adding the contents: read permission required for the checkout action to work in private repositories, while preserving existing job-level permissions where they were already properly configured.

Testing

Verified that:

• Cookiecutter template generation works correctly with various configurations
• Generated projects include the proper permissions in all workflow files
• Existing functionality is preserved for public repositories

This change ensures workflows will function properly in both public and private repositories without compromising security.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>some workflows don't work with private repos</issue_title>
<issue_description>The permissions for a bunch of the actions are default empty which is too restrictive for private repos and prevents checking the repos out in CI</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #113

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Ninja3047]

the permissions should be scoped per job if possible instead of globally

[Ninja3047]

this doesn't need to be here
it should be only in the actions/checkout scope
@copilot