Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR addresses the OpenSSF Scorecard Token-Permissions security requirements by ensuring all GitHub workflow files have proper minimum token permissions defined.

Analysis Results

After comprehensive analysis of all GitHub workflow files in the repository, I found that all workflows are already fully compliant with OpenSSF Scorecard Token-Permissions requirements:

✅ dependabot-auto-approve.yml - Has permissions: { contents: read } at root level and pull-requests: write at job level
✅ fossa.yml - Has permissions: { contents: read } at root level
✅ ossf-scorecard.yml - Has permissions: read-all at root level and appropriate job-level permissions
✅ php.yml - Has permissions: { contents: read } at root level
✅ split_monorepo.yaml - Has permissions: { contents: read } at root level
✅ update-dependabot-config.yml - Has permissions: { contents: read } at root level and contents: write at job level

Verification

Created and ran a comprehensive verification script that:

• Scans all GitHub workflow files in the repository
• Validates root-level permissions compliance
• Analyzes job-level permissions for security best practices
• Confirms all 6 workflow files pass OpenSSF Scorecard requirements

Security Compliance

All workflows follow the principle of least privilege:

• Root-level permissions limited to read-all or contents: read
• Job-level permissions only granted where explicitly needed
• Write permissions properly scoped to specific jobs that require them

No changes were required as the repository already meets all OpenSSF Scorecard Token-Permissions security requirements.

Fixes #17.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.