Adjust permissions for github actions

[vratins]

Currently the ruff, ty, and pytest all run automatically with a PR and all associated commits -- want to change this so that only a repo admin can approve builds.

Edit: this requires changes to the settings which needs to be done by a repo admin (@marcuscollins, @stephaniewankowicz)

[marcuscollins]

Created environment testing https://github.com/diff-use/WaterFlow/settings/environments/13416676744/edit