Cardano Updates

Add permissions block with contents: read, required by
actions/checkout to clone the repository.

Fixes https://github.com/IntersectMBO/cardano-updates/security/code-scanning/3

Add permissions block with contents: write, required by
peaceiris/actions-gh-pages to push build output to the gh-pages branch.

Fixes https://github.com/IntersectMBO/cardano-updates/security/code-scanning/4

In Docusaurus 2, relative links like `(2023-01-05-ledger)` in blog/quarterly
posts resolved correctly. In Docusaurus 3.9, the broken-link checker validates
links not only from the post's own page but also from all generated pages that
embed the post (pagination pages like /quarterly/page/2, tag pages like
/quarterly/tags/ledger). Since those pages live at different URL paths, a
relative link like `2023-01-05-ledger` resolves to the wrong path
(e.g. /quarterly/page/2023-01-05-ledger instead of /quarterly/2023-01-05-ledger).

Fix: replace relative slugs with absolute paths (/quarterly/<slug>) so links
resolve correctly regardless of which generated page renders them.