CI: Restrict default permissions

Reduces risk of arbitrary code is run by attacker.

Author: tacaswell

.github/workflows/mplfinance_checks.yml

@@ -1,4 +1,6 @@
 name: mplfinance Checks
+permissions:
+  contents: read
 on: [ workflow_dispatch, pull_request ]
 jobs:
   Regression_Tests:

.github/workflows/pubPyPI.yml

@@ -1,4 +1,6 @@
 name: Upload Mplfinance to PyPI
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:
@@ -10,6 +12,10 @@ on:
 
 jobs:
   build_and_deploy:
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repository
@@ -18,7 +24,7 @@ jobs:
         ref: ${{ github.event.inputs.tag }}
         persist-credentials: false
 
-    - name: Display Coded Version 
+    - name: Display Coded Version
       #run: git show ${{ github.sha }}:src/mplfinance/_version.py
       run: egrep 'version_info .*=' src/mplfinance/_version.py
 
@@ -32,7 +38,7 @@ jobs:
         python -m pip install --upgrade pip
         pip install setuptools wheel twine
 
-    - name: Build 
+    - name: Build
       run: |
         python setup.py sdist bdist_wheel
         ls -l dist/*

.github/workflows/pubTestPyPI.yml

@@ -1,4 +1,6 @@
 name: Upload Mplfinance to TestPyPI
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:
@@ -12,13 +14,17 @@ jobs:
   build_and_deploy:
     runs-on: ubuntu-latest
     steps:
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
     - name: Checkout Repository
       uses: actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.tag }}
         persist-credentials: false
 
-    - name: Display Coded Version 
+    - name: Display Coded Version
       #run: git show ${{ github.sha }}:src/mplfinance/_version.py
       run: egrep 'version_info .*=' src/mplfinance/_version.py
 
@@ -32,7 +38,7 @@ jobs:
         python -m pip install --upgrade pip
         pip install setuptools wheel twine
 
-    - name: Build 
+    - name: Build
       run: |
         python setup.py sdist bdist_wheel
         ls -l dist/*