Remove required permissions from jobs

[charisk]

These are no longer required since we're using signed auth tokens.

[koesie10]

Thanks!

[robertbrignull]

There are a few places in .github/workflows/codeql-query.yml that we reference GITHUB_TOKEN, and I think all of those can be removed. We are passing the token into the action as an env var but then we aren't actually using the token in the action, because all requests are now authenticated using the signed auth token.

I suggest we try deleting all references to GITHUB_TOKEN and then do another manual test to confirm it still works.

[robertbrignull]

(As said on slack as well), the general approach here looks good to me. We aren't using these permissions anymore so the right thing to do is to remove the requirement for them.