Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR adds minimum token permissions for all GitHub workflow files to improve security posture according to OpenSSF Scorecard recommendations.

Overview

The OpenSSF Scorecard Token-Permissions check requires that all GitHub workflow files have a root-level permissions: block to limit token access to the minimum required permissions. This PR addresses that requirement by adding permissions: contents: read to all workflow files that were missing this security configuration.

Changes Made

• 16 workflow files updated with new root-level permissions blocks
• 2 workflow files already had proper permissions (fossa.yml, ossf-scorecard.yml)
• All changes follow the existing formatting patterns in each file
• No existing functionality impacted

Files Updated

All files now have a root-level permissions block with contents: read:

• .github/workflows/backport.yml
• .github/workflows/changelog.yml
• .github/workflows/codeql-analysis.yml
• .github/workflows/component-owners.yml
• .github/workflows/core_contrib_test_0.yml
• .github/workflows/lint_0.yml
• .github/workflows/misc_0.yml
• .github/workflows/package-prepare-patch-release.yml
• .github/workflows/package-prepare-release.yml
• .github/workflows/package-release.yml
• .github/workflows/prepare-patch-release.yml
• .github/workflows/prepare-release-branch.yml
• .github/workflows/release.yml
• .github/workflows/test_0.yml
• .github/workflows/test_1.yml
• .github/workflows/test_2.yml

Security Benefits

• Principle of least privilege: Each workflow now explicitly declares minimum required permissions
• Reduced attack surface: Limits potential damage if a workflow is compromised
• OpenSSF Scorecard compliance: Improves the project's security score
• Explicit permission model: Makes token usage transparent and auditable

Job-Level Permissions Preserved

Existing job-level permissions for specialized functionality remain intact:

• component-owners.yml: Job retains issues: write and pull-requests: write for PR/issue management
• ossf-scorecard.yml: Job retains security-events: write and id-token: write for code scanning

Verification

All 18 workflow files have been verified to:

• ✅ Pass OpenSSF Scorecard Token-Permissions requirements
• ✅ Parse as valid YAML
• ✅ Maintain existing functionality
• ✅ Follow consistent formatting patterns

Fixes #16.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.