Harden GitHub Actions workflows

[bboe]

Hardens the org's shared GitHub Actions workflows, surfaced by running zizmor across all praw-dev repos.

Changes

• Scope GITHUB_TOKEN permissions to the job level in stale_action.yml and tag_release.yml. The permissions: blocks were declared at the workflow level (granting the token to every job); they now sit on the specific job, with a deny-all permissions: {} default at the top level. Resolves zizmor's high-severity excessive-permissions findings and adds explanatory comments (undocumented-permissions). No functional change to the granted scopes.
• Make lint.yml reusable by adding a workflow_call: trigger (alongside the existing push/pull_request), so the actionlint + zizmor jobs can be called from the other praw-dev repos. This repo continues to lint itself via the same file.

Follow-up

Once this is released, the other repos will gain a thin lint.yml caller pinned to the new release, bringing zizmor/actionlint coverage to every repo.