Workflows have no `permissions:` block

[goelakash]

ci.yml, fds_compat.yml run with the repository default token permissions. Declaring permissions: per workflow scopes each run to what it actually needs.

Feel free to close if this is incorrect.