fix(ci): restrict manual candidate test workflows to read-only caches (#31887)

.github/workflows/packaged-browser-e2e.yml

@@ -18,6 +18,9 @@ on:
         required: false
 permissions:
   contents: read
+
+# Candidate source must not write caches in the dispatch branch's scope.
+cache-mode: read
 jobs:
   compatibility:
     runs-on: ubuntu-latest

.github/workflows/terminal-perf.yml

@@ -51,6 +51,9 @@ on:
 permissions:
   contents: read
 
+# Candidate source must not write caches in the dispatch branch's scope.
+cache-mode: read
+
 jobs:
   terminal-perf:
     name: terminal scale perf

.github/workflows/windows-wsl-e2e.yml

@@ -16,6 +16,9 @@ on:
 permissions:
   contents: read
 
+# Candidate source must not write caches in the dispatch branch's scope.
+cache-mode: read
+
 concurrency:
   group: windows-wsl-e2e-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true