default token permissions should match github actions default #200
Description
When the workflow does not specify a permission, we currently provide a more permissions than the default github actions. This could be surprising. We should default to content/metadata:read