Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR adds minimum token permissions to all GitHub workflow files to improve security posture according to OpenSSF Scorecard recommendations.

Changes Made

Root-Level Permissions Added

Added permissions: contents: read to 14 workflow files that were missing root-level permissions:

• check-spelling.yml
• ci-contrib.yml
• ci-instrumentation-with-services.yml
• ci-instrumentation.yml
• ci-markdown-link.yml
• ci-markdownlint.yml
• installation-tests.yml
• release-hook-on-closed.yml
• release-hook-on-push.yml
• release-perform.yml
• release-request-weekly.yml
• release-request.yml
• release-retry.yml
• stale.yaml

Over-Permissive Root-Level Permissions Fixed

Fixed 2 workflow files with over-permissive root-level permissions by moving specific permissions to job level:

• conventional-commits.yaml: moved pull-requests: read to job level
• release-please.yaml: moved contents: write, pull-requests: write to job level

Job-Level Permissions Added

Added appropriate job-level permissions for workflows that need write access:

• ci-markdown-link.yml: pull-requests: write for PR review comments
• stale.yaml: issues: write, pull-requests: write for labeling/closing issues and PRs
• Release workflows (5 files): contents: write, pull-requests: write for release management

Already Compliant Files

2 workflow files were already compliant:

• fossa.yml: already had permissions: contents: read
• ossf-scorecard.yml: already had permissions: read-all

Implementation Details

• All root-level permissions are now limited to contents: read or read-all only
• Write permissions are moved to job level where actually needed
• Proper blank line formatting maintained according to existing file styles
• All changes are minimal and surgical - only adding necessary permissions blocks

Verification

All 18 workflow files now pass OpenSSF Scorecard Token-Permissions check requirements:

• ✅ Every workflow has root-level permissions defined
• ✅ Root-level permissions are appropriately restrictive
• ✅ Write permissions are scoped to specific jobs that need them
• ✅ All YAML files remain syntactically valid

Fixes #16.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.