Request gotestfmt with readonly access token

Per the advice at ed11bda1c4/README.md (L33-L34)

.github/workflows/tests.yml

@@ -6,6 +6,11 @@ on:
     pull_request:
         branches: ["main"]
 
+permissions:
+  packages: read
+  # Note: from https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
+  # > If you specify the access for any of these scopes, all of those that are not specified are set to none.
+
 jobs:
     integration:
         runs-on: ubuntu-latest
@@ -44,6 +49,9 @@ jobs:
 
             - name: Set up gotestfmt
               uses: GoTestTools/gotestfmt-action@v2
+              with:
+                # Note: constrained to `packages:read` only at the top of the file
+                token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Test
               run: |
@@ -115,6 +123,9 @@ jobs:
 
             - name: Set up gotestfmt
               uses: GoTestTools/gotestfmt-action@v2
+              with:
+                # Note: constrained to `packages:read` only at the top of the file
+                token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Run end-to-end tests
               run: |