Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR implements minimum token permissions for all GitHub workflow files to improve security posture according to OpenSSF Scorecard recommendations.

Changes Made

Root-Level Permissions Compliance

• 12 workflow files were already compliant with proper root-level permissions:
  • ci.yml, clang-tidy.yaml, cmake_install.yml, codeql-analysis.yml, cppcheck.yml, dependencies_image.yml, fossa.yml, iwyu.yml, project_management_comment.yml, project_management_issue_open.yml, stale.yml - all have permissions: contents: read
  • ossf-scorecard.yml - has permissions: read-all (compliant)

Fixed Non-Compliant File

• benchmark.yml - Had overly broad root-level permissions that violated the principle of least privilege:
  • Before: Root-level contents: write and deployments: write permissions
  • After: Root-level contents: read permission with job-specific write permissions

Job-Level Permissions

Added appropriate job-level permissions to the store_benchmark job in benchmark.yml:

permissions:
  contents: write # required for pushing benchmark results to gh-pages
  deployments: write # required for GitHub Pages deployment

Security Benefits

1. Reduced Attack Surface: Write permissions are now scoped only to jobs that actually need them
2. Principle of Least Privilege: Root-level permissions limited to read-only access
3. OpenSSF Scorecard Compliance: Addresses the Token-Permissions check recommendations
4. Minimal Changes: Only modified what was necessary, preserving existing functionality

Verification

All 13 workflow files now pass the Token-Permissions security check:

• ✅ Root-level permissions are either contents: read or read-all
• ✅ Write permissions are properly scoped to specific jobs that require them
• ✅ Existing workflow functionality is preserved

Fixes #57.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.