chore: restrict GitHub workflow permissions - future-proof

[incertum]

See swiftlang/github-workflows#167 for additional context

This approach aligns with security best practices, as detailed in the following documentation:

• https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
• https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes
• https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/

[ahoppen]

Thanks a lot for the PR, @incertum 🙏🏽 Two quick questions:

• Out of curiosity, do you know what the default permissions are if they are not specified? Does this PR just
• The automerge workflow requires contents: write permission in the create_merge_pr job. Do you know / did you check if it’s possible that a job has more permissions than the surrounding workflow?