ci: Add explicit permissions to workflows

.github/workflows/build-lint-test.yml

@@ -3,6 +3,9 @@ name: Build, Lint, and Test
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   prepare:
     name: Prepare

.github/workflows/main.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check-workflows:
     name: Check workflows
@@ -71,6 +74,7 @@ jobs:
       - check-workflows
       - analyse-code
       - build-lint-test
+    permissions: {}
     outputs:
       PASSED: ${{ steps.set-output.outputs.PASSED }}
     steps:
@@ -83,6 +87,7 @@ jobs:
     if: ${{ always() }}
     runs-on: ubuntu-latest
     needs: all-jobs-completed
+    permissions: {}
     steps:
       - name: Check that all jobs have passed
         run: |

.github/workflows/publish-release.yml

@@ -9,6 +9,10 @@ on:
         required: true
       PUBLISH_DOCS_TOKEN:
         required: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build