Ensure workflows are properly scoped down to the job-level

[anthonyting]

Some of our GH workflows are not properly scoped down to the job-level (mainly the sync scripts). We should check them and make sure they are scoped properly so that id-token: write is only specified at the job level and not at the workflow level.

See:

• https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions
• https://docs.github.com/en/enterprise-cloud@latest/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository