ci: reduce workflow permissions to minimum

.github/workflows/automerge.yml

@@ -8,6 +8,10 @@ on:
         workflows: ["CI"]
         types: [completed]
 
+permissions:
+    contents: read
+    pull-requests: write
+
 jobs:
     on-success:
         if: >

.github/workflows/cd.yml

@@ -10,6 +10,10 @@ on:
     # Allows this workflow to be run manually from the Actions tab
     workflow_dispatch:
 
+permissions:
+    contents: write
+    pull-requests: write
+
 jobs:
     release:
         name: Create/Update Release Pull Request

.github/workflows/ci.yml

@@ -18,6 +18,9 @@ on:
             - "*.md"
         types: [opened, ready_for_review, reopened, synchronize]
 
+permissions:
+    contents: read
+
 # This allows a subsequently queued workflow run to interrupt previous runs
 concurrency:
     group: "${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"

.github/workflows/codeql.yml

@@ -19,8 +19,6 @@ on:
         types: [opened, ready_for_review, reopened, synchronize]
 
 permissions:
-    actions: read
-    contents: read
     security-events: write
 
 # This allows a subsequently queued workflow run to interrupt previous runs

.github/workflows/link-check.yml

@@ -29,6 +29,9 @@ on:
     # Allows this workflow to be run manually from the Actions tab
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
     link-check:
         name: Link Check