build(ci): use explicit permissions in workflows

This addresses CodeQL Rule ID actions/missing-workflow-permissions.

Author: h4l

.github/workflows/main.yml

@@ -1,4 +1,6 @@
 name: "Main"
+permissions:
+  contents: read
 on:
   push:
     branches:

.github/workflows/publish.yml

@@ -1,4 +1,6 @@
 name: publish
+permissions:
+  contents: read
 on:
   push:
     tags:
@@ -54,6 +56,7 @@ jobs:
     environment: release
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
     steps: