Harden GitHub Actions token permissions (#121) (#122)

Author: mother-6000

.github/workflows/ci.yml

@@ -1,4 +1,5 @@
 name: ci
+permissions: read-all
 on:
   push:
     branches: [ main ]
@@ -24,6 +25,9 @@ jobs:
   build:
     runs-on: ${{ matrix.os }}
     needs: cpplint
+    permissions:
+      contents: read
+      actions: write
     strategy:
       matrix:
         os: [ ubuntu-24.04, windows-2022 ]