fix(ci): restrict GITHUB_TOKEN permissions in mutation workflow

fix(ci): restrict GITHUB_TOKEN permissions in mutation workflow #1587