Build/Test Tools: Add some missing permissions to the GitHub Actions workflows.

These permissions are not required for a public repo but are required for a private repo, for example a private fork.

Merges [60612], [60624] to the 6.8 branch.

Props johnbillion, desrosj.
See #63170

git-svn-id: https://develop.svn.wordpress.org/branches/6.8@60773 602fd350-edb4-49c9-b593-d223f7449a82

Author: desrosj

.github/workflows/check-built-files.yml

@@ -44,3 +44,5 @@ jobs:
     # This prevents an unnecessary second run after changes are committed back because Dependabot always rebases and force pushes.
     if: ${{ github.repository == 'wordpress/wordpress-develop' && ( github.actor != 'dependabot[bot]' || github.event.commits < 2 ) }}
     uses: WordPress/wordpress-develop/.github/workflows/reusable-check-built-files.yml@trunk
+    permissions:
+      contents: read

.github/workflows/performance.yml

@@ -52,7 +52,8 @@ jobs:
     name: Determine Matrix
     runs-on: ubuntu-24.04
     if: ${{ ( github.repository == 'WordPress/wordpress-develop' || ( github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' ) ) && ! contains( github.event.before, '00000000' ) }}
-    permissions: {}
+    permissions:
+      actions: read
     env:
       TARGET_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
     outputs:

.github/workflows/upgrade-develop-testing.yml

@@ -56,6 +56,8 @@ jobs:
     uses: WordPress/wordpress-develop/.github/workflows/reusable-upgrade-testing.yml@trunk
     if: ${{ github.repository == 'WordPress/wordpress-develop' || ( github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' ) }}
     needs: [ build ]
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix: