Merge pull request #31 from step-security-bot/stepsecurity_remediation_1732860711

[StepSecurity] ci: Harden GitHub Actions

Author: FlysonBot

.github/workflows/changelog.yaml

@@ -5,6 +5,9 @@ on:
     tags:
       - 'v*'  # Triggers on tags that start with 'v'
 
+permissions:
+  contents: read
+
 jobs:
   changelog:
     name: Generate changelog

.github/workflows/coveralls.yaml

@@ -2,6 +2,9 @@ on: ["push", "pull_request"]
 
 name: Coveralls Test Coverage
 
+permissions:
+  contents: read
+
 jobs:
   coveralls:
     runs-on: ubuntu-latest