CI: storybook given write contents perms; RetPageOrigin removes all

[DougReeder]

What?

CI: storybook given write contents perms; RetPageOrigin removes all

Why?

scopes the permissions to what is actually needed, for security

Examples

n/a

How to test

1. cherry-pick the commit to the master branch of your personal repo
2. push to GitHub; observe that both actions run without errors

Documentation of functionality

n/a

Limitations

none

Alternative implementations considered

For tighter security, we might rewrite the storybook workflow so we only need to give it write permission when it's on the master branch, but that would excessivly complicate a workflow we're not really taking advantage of.

Open questions

None

Additional details or related context

This probably should have been done as part of the earlier CI permissions PR.

[github-actions]

Thank you for the pull request.

ROADMAP STATUS: This pull request isn't currently on any roadmap. Updates will be conveyed here as its place on/off a roadmap changes.

You can view the roadmaps here: Roadmaps Google Drive folder.

For more information on how the roadmaps work, see our roadmaps policy on GitHub.

[Exairnous]

LGTM. Thanks.

Note: This PR also removes branches from the list of triggers, I assume because no branches are specified which means it triggers on a push to any branch and thus the line doesn't do anything/isn't needed.