Scope GitHub Actions token permissions per job in go.yml

[Copilot]

This workflow currently defined token scopes at the workflow level, causing all jobs to inherit permissions they do not need. This change scopes permissions at the job level so each job gets only the minimum required access.

• Permission model change

  • Removed top-level permissions from .github/workflows/go.yml.
  • Added explicit permissions blocks to each job.

• build job scopes

  • Kept required scopes local to build:
    • contents: read
    • pull-requests: read
    • checks: write

• race job scopes

  • Added only contents: read for checkout/test execution.
  • Avoids inheriting PR/check write capabilities not used by this job.

jobs:
  build:
    permissions:
      contents: read
      pull-requests: read
      checks: write

  race:
    permissions:
      contents: read

[robbyt]

@claude review and fix this if needed