ci: set minimal permissions to github workflows (#4665)

* set ci.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set configure.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set format.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set pip.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set upstream.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set labeler.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* Update ci.yml to read all

Signed-off-by: Joyce <joycebrum@google.com>

* test labeler.yml

Signed-off-by: Joyce <joycebrum@google.com>

* restore the if at labeler.yml

Signed-off-by: Joyce <joycebrum@google.com>

---------

Signed-off-by: Joyce <joycebrum@google.com>