[EngSys] Default all workflow perms to "content: read" (#32388)

- Should have no real-world security impact
- Follows principle of least-priviliges

Author: mikeharder

.github/workflows/SDK-Suppressions-Label.yaml

@@ -7,12 +7,13 @@ on:
       - RPSaaSMaster
       - release*
 
+permissions:
+  contents: read
+
 jobs:
   process-sdk-suppressions-labels:
     name: Sdk Suppressions
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/_reusable-eng-tools-test.yaml

@@ -20,6 +20,9 @@ on:
         required: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:

.github/workflows/github-test.yaml

@@ -11,6 +11,9 @@ on:
       - .github/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash

.github/workflows/protected-files.yaml

@@ -2,6 +2,9 @@ name: Protected Files
 
 on: pull_request
 
+permissions:
+  contents: read
+
 env:
   # Users allowed to edit protected files without failing check
   user-allowed: ${{ github.event.pull_request.user.login == 'azure-sdk' }}

.github/workflows/specs-model-test.yaml

@@ -17,6 +17,9 @@ on:
       - eng/tools/specs-model/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   specsModel:
     name: Specs Model

.github/workflows/spelling-all.yaml

@@ -11,6 +11,9 @@ on:
     - cron: "6 12 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     name: SpellCheck

.github/workflows/spelling.yaml

@@ -2,6 +2,9 @@ name: SpellCheck
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     name: SpellCheck

.github/workflows/suppressions-test.yaml

@@ -17,6 +17,9 @@ on:
       - eng/tools/suppressions/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   suppressions:
     uses: ./.github/workflows/_reusable-eng-tools-test.yaml

.github/workflows/tsp-client-test.yaml

@@ -20,6 +20,9 @@ on:
       - specification/contosowidgetmanager
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   tsp-client:
     uses: ./.github/workflows/_reusable-eng-tools-test.yaml

.github/workflows/typespec-requirement-test.yaml

@@ -17,6 +17,9 @@ on:
       - eng/tools/typespec-requirement/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   typespec-requirement:
     uses: ./.github/workflows/_reusable-eng-tools-test.yaml