Update docs with permissions information

[CasperWA]

Whenever permissions is used to alter or "ensure" the minimum required permissions for GITHUB_TOKEN, this should be mentioned and highlighted in the documentation.
Since the called workflow might fail if the permissions is not also set accordingly in the caller workflow.

There are in general 2 different approaches:

1. Set the permissions in the caller workflow (either at top-level or for the job that calls the called workflow).
2. Change the default GITHUB_TOKEN permissions for the repository to the "permissive" scope.

For the second option, the setting in question looks like this:

[CasperWA]

This has been addressed somewhat for the new PyPI Trusted Publisher feature (see #267). However, here the permissions are set externally to the reusable workflows, since this feature currently does not work within a reusable workflow.