CI: Add permissions to GitHub Actions

This change locks down the permissions of the access token in GitHub Actions to
only allow reading the repository contents and nothing else.

see https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token

.github/workflows/codespell.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: "0 0 * * 2"
 
+permissions:
+  contents: read
+
 jobs:
   codespell:
 

.github/workflows/compliance.yml

@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "0 0 * * 3"
 
+permissions:
+  contents: read
+
 jobs:
   h2spec:
     name: h2spec

.github/workflows/contrib.yml

@@ -3,6 +3,9 @@ name: Contrib
 on:
   push:
 
+permissions:
+  contents: read
+
 jobs:
   build:
 

.github/workflows/coverity.yml

@@ -9,6 +9,9 @@ on:
   schedule:
   - cron: "0 0 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   scan:
     runs-on: ubuntu-latest

.github/workflows/musl.yml

@@ -2,6 +2,9 @@ name: alpine/musl
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   musl:
       name: gcc

.github/workflows/openssl-nodeprecated.yml

@@ -14,6 +14,9 @@ on:
   schedule:
     - cron: "0 0 * * 4"
 
+permissions:
+  contents: read
+
 jobs:
   test:
 

.github/workflows/vtest.yml

@@ -11,6 +11,9 @@ name: VTest
 on:
   push:
 
+permissions:
+  contents: read
+
 jobs:
   # The generate-matrix job generates the build matrix using JSON output
   # generated by .github/matrix.py.

.github/workflows/windows.yml

@@ -11,6 +11,9 @@ name: Windows
 on:
   push:
 
+permissions:
+  contents: read
+
 jobs:
   msys2:
     name: ${{ matrix.name }}