ci: Set and enforce more default permissions (#60222)

Release Notes:

- N/A

extensions/workflows/run_tests.yml

@@ -8,6 +8,8 @@ on:
   push:
     branches:
     - main
+permissions:
+  contents: read
 jobs:
   call_extension_tests:
     permissions:

extensions/workflows/shared/bump_version.yml

@@ -11,6 +11,7 @@ on:
     paths-ignore:
     - .github/**
   workflow_dispatch: {}
+permissions: {}
 jobs:
   determine_bump_type:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')