unified-runtime

[CI] Set top-level permissions to least required in all workflows

#2843

Merged