This is a follow-up of #14026 (that was a redo of #13397). In that PR, permissions were set but not for all the workflows (we have so many!). Would be nice if we update the rest to be consistent throughout.