[Sandijigs]

Without explicit permissions, the job may inherit a token with unnecessary write access. Setting permissions: {} removes its GITHUB_TOKEN permissions, so it only has the access it needs.

The job only checks out public code, builds, and tests, so it doesn't need token permissions.

This resolves zizmor's excessive-permissions finding as part of enforcing the lint across rust-lang repositories through crabwatch, tracked in this crabwatch issue