Add explicit permissions, matching the default 'restricted' set, to a…

…ll workflows.

see: https://docs.github.com/en/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token

This is an experiment to explore what will break when we switch our org level default from 'permissive' to 'restricted'.

see also: actions/upload-artifact#197 (comment)

.github/workflows/assemble.yml

@@ -4,6 +4,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  metadata: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/check.yml

@@ -4,6 +4,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  metadata: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/docs.yml

@@ -3,6 +3,11 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  contents: read
+  metadata: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/emulate.yml

@@ -4,6 +4,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  metadata: read
+
 jobs:
   check:
     runs-on: macos-latest

.github/workflows/publish.yml

@@ -8,6 +8,10 @@ on:
         description: 'Version, without v prefix, appended to v to locate tag'
         required: true
 
+permissions:
+  contents: read
+  metadata: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest