fix(ci): add least-privilege permissions to workflow files

Add top-level permissions blocks following the two-tier permission
pattern recommended by OpenSSF Scorecard:

- stale.yml: add `permissions: {}` at workflow level (job already has
  issues: write + pull-requests: write)
- build_external_container_images.yaml: move `packages: write` from
  workflow level to job level; set workflow level to `permissions: read-all`

scm_configuration_check.yaml already had `permissions: read-all` at
workflow level so no change was needed.

Fixes #2841

Signed-off-by: Vibhav Bobade <vibhav.bobde@gmail.com>

Author: waveywaves

.github/workflows/build_external_container_images.yaml

@@ -3,14 +3,15 @@ name: Build Bitnami Container Images
 on:
   workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
+permissions: read-all
 
 jobs:
   build_and_push_images:
     name: Build and Push ${{ matrix.image.name }} Image
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         image:

.github/workflows/stale.yml

@@ -5,6 +5,8 @@ on:
     - cron: '30 1 * * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   close-issues:
     runs-on: ubuntu-latest