ci(backport): Update CI permissions changes

[matthewfeickert]

Description

• Backport:
  • PR ci: Add simplified CI for Windows #2363
  • PR ci: Place upper bound on min supported setuptools #2479
  • PR ci: Update permissions for GitHub attestations #2481
  • PR [StepSecurity] ci: Restrict token permissions to harden GitHub Actions #2483
  • PR ci: Don't test warnings on release tests #2489

Checklist Before Requesting Reviewer

• Tests are passing
• "WIP" removed from the title of the pull request
• Selected an Assignee for the PR to be responsible for the log summary

Before Merging

For the PR Assignees:

• Summarize commit messages into a comprehensive review of the PR

* Backport:
   - PR https://github.com/scikit-hep/pyhf/pull/2363
   - PR https://github.com/scikit-hep/pyhf/pull/2479
   - PR https://github.com/scikit-hep/pyhf/pull/2481
   - PR https://github.com/scikit-hep/pyhf/pull/2483
   - PR https://github.com/scikit-hep/pyhf/pull/2489

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Please upload report for BASE (release/v0.7.x@16840f6). Learn more about missing BASE report.

Additional details and impacted files

@@                Coverage Diff                @@
##             release/v0.7.x    #2505   +/-   ##
=================================================
  Coverage                  ?   98.19%           
=================================================
  Files                     ?       69           
  Lines                     ?     4547           
  Branches                  ?      804           
=================================================
  Hits                      ?     4465           
  Misses                    ?       49           
  Partials                  ?       33           

Flag	Coverage Δ
contrib	97.73% <ø> (?)
doctest	98.02% <ø> (?)
unittests-3.10	96.19% <ø> (?)
unittests-3.11	96.19% <ø> (?)
unittests-3.12	96.19% <ø> (?)
unittests-3.7	96.17% <ø> (?)
unittests-3.8	96.21% <ø> (?)
unittests-3.9	96.23% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.