ci: set explicit permissions (#229)

Author: eyurtsev

.github/workflows/_test.yml

@@ -1,5 +1,8 @@
 name: test
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/ci.yml

@@ -1,6 +1,9 @@
 ---
 name: Run CI Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main ]

.github/workflows/release.yml

@@ -25,6 +25,8 @@ env:
 
 jobs:
   build:
+    permissions:
+      contents: read
     if: github.ref == 'refs/heads/main' || inputs.dangerous-nonmain-release
     environment: Scheduled testing
     runs-on: ubuntu-latest