Merge pull request rails#50214 from zzak/gha/rails-new-docker/read-permissions-only

Ensure all GH Actions set to read-only contents

Author: byroot

.github/workflows/rails-new-docker.yml

@@ -2,6 +2,9 @@ name: rails-new-docker
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 env:
   APP_NAME: devrails
   APP_PATH: dev/devrails