Update workflow example in the README

[st3fan]

This patch makes the following changes to the example workflow in the README.md:

• pin the actions/checkout action to v2 instead of master
• set persist-credentials: false as a good practice so that the $GITHUB_TOKEN is not made available to any action unless explicitly configured (checkout will sneakily write the token to disk where any step can pick it up)
• Add a permissions section to limit the scope of the $GITHUB_TOKEN to just be able to read the repo contents and add security events.

Assuming many folks copy/paste the example workflow from the README.md, I think these are good security changes to encourage.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[owenrumney]

Thanks