xla

ci: declare workflow-level `contents: read` on 3 workflows

#9768

Open