github: Move permissions to the individual jobs

SonarQube complains about workflow-level "allow" permissions.

.github/workflows/macos.yml

@@ -6,9 +6,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  actions: write
-
 env:
   TESTS_REDUCED_KEYLENGTHS: yes
   CCACHE_BASEDIR: ${{ github.workspace }}
@@ -36,6 +33,8 @@ jobs:
     if: ${{ needs.pre-check.outputs.should_skip != 'true' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
+    permissions:
+      actions: write
     env:
       TEST: macos
     steps: