Harden cron-conda workflow by explicitly scoping GITHUB_TOKEN permissions

[Copilot]

This addresses the code scanning finding for missing explicit workflow token permissions in .github/workflows/cron-conda.yml. The workflow now declares permissions explicitly and limits write scope to only the job that needs repository mutation.

• Security posture: explicit token scope

  • Added workflow-level permissions with contents: read to avoid implicit/default token grants.

• Least-privilege job override

  • Added job-level permissions on conda-update with contents: write so write access is available only where commit/push/release operations occur.

• Resulting permission model

  permissions:
    contents: read
  
  jobs:
    conda-update:
      permissions:
        contents: write