ci: test using no permissions by default for most CI jobs + bump setup-python (#2025)

* ci: test using no permissions by default for most CI jobs

* Also require production approval for a release upload

* remove build_release individual 'job'

* tweak some stuff

* driveby bump on setup-python to 6.2.0 to fix node20 warnings

* remove bsd vm check name

.github/workflows/clear_workflow_cache.yml

@@ -15,6 +15,8 @@ on:
   schedule:
     - cron: "0 11 * * 0"
 
+permissions: {}
+
 jobs:
   clear-cache:
     if: ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }} # If it is a PR, only if not a fork