GH-49729: [CI] Scope workflow permissions and secret inheritance

[thisisnic]

Rationale for this change

CI jobs allow secrets to be inherited which could present a security risk

What changes are included in this PR?

Scope permissions better

Are these changes tested?

Will be once we merge

Are there any user-facing changes?

No

• GitHub Issue: [CI] Scope workflow permissions and secret inheritance #49729

[github-actions]

⚠️ GitHub issue #49729 has been automatically assigned in GitHub to PR creator.

[thisisnic]

I think the failing jobs are ones which are failing on main, but perhaps we wait for those to be fixed so I can rebase and properly check they pass here.

[kou]

+1

report_ci is only triggered by schedule event. (Nightly jobs.)

So we can't test this with PR.

Could you fill the PR description before we merge this?

[conbench-apache-arrow]

After merging your PR, Conbench analyzed the 3 benchmarking runs that have been run so far on merge-commit 1cfbb67.

There were no benchmark performance regressions. 🎉

The full Conbench report has more details. It also includes information about 1 possible false positive for unstable benchmarks that are known to sometimes produce them.