test(ci): add github token minimal permissions in all workflows

[mikehardy]

Should fix CodeQL code scanning alerts

Appears to me that the workflows only need contents: read for the github token, but I suppose we'll see

• https://github.com/ankidroid/Anki-Android-Backend/security/code-scanning/1
• https://github.com/ankidroid/Anki-Android-Backend/security/code-scanning/2
• https://github.com/ankidroid/Anki-Android-Backend/security/code-scanning/3
• https://github.com/ankidroid/Anki-Android-Backend/security/code-scanning/4
• https://github.com/ankidroid/Anki-Android-Backend/security/code-scanning/5
• https://github.com/ankidroid/Anki-Android-Backend/security/code-scanning/6

[david-allison]

Sure! Can we do a test publish after this goes through

[mikehardy]

Definitely +1 on test publish, will merge dependencies prior and set a new internal version
Just checked ankitects/anki releases and there is nothing new there so nothing fancy to include

[mikehardy]

That's annoying, they were running full / expected speed it seems

@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to no response for status checks 8 minutes ago

[mikehardy]

1- successful publish! https://repo1.maven.org/maven2/io/github/david-allison/anki-android-backend/0.1.63-anki25.09.2/
2- security queue cleared, that's the whole org cleared now

Okay, there is still apparently some warning here, I'll look into that - it was running green throughout the day 🤔

[mikehardy]

Ah, it's generated rust code - going to ignore for now but could use a preen later if someone wanted something unimportant to pick at that had no real world purpose ("tuning github actions codeql scanning to ignore generated code" ? meh)

https://github.com/ankidroid/Anki-Android-Backend/security/code-scanning/tools/CodeQL/status/configurations/actions-FZTWS5DIOVRC653POJVWM3DPO5ZS6Y3PMRSXC3BOPFWWY/2093ca42bf4614785abc8bd8107185ea3f3395dfef51a1f83c7ed582118bb8b2