fix(ci): add least-privilege permissions to workflow files

Add top-level permissions blocks following the two-tier permission
pattern recommended by OpenSSF Scorecard:

- stale.yml: add `permissions: {}` at workflow level (job already has
  issues: write + pull-requests: write)
- build_external_container_images.yaml: move `packages: write` from
  workflow level to job level; set workflow level to `permissions: read-all`

scm_configuration_check.yaml already had `permissions: read-all` at
workflow level so no change was needed.

Fixes #2841

Signed-off-by: Vibhav Bobade <vibhav.bobde@gmail.com>

Author: waveywaves

.github/workflows/build_external_container_images.yaml

@@ -5,12 +5,14 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   build_and_push_images:
     name: Build and Push ${{ matrix.image.name }} Image
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         image:

.github/workflows/codeql.yml

@@ -11,7 +11,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write # required for SLSA attestation
 
 jobs:
   analyze:

.github/workflows/stale.yml

@@ -5,6 +5,10 @@ on:
     - cron: '30 1 * * *'
   workflow_dispatch:
 
+# Job-level permissions completely replace workflow-level defaults, so the
+# token only receives the job's issues: write + pull-requests: write grants.
+permissions: {}
+
 jobs:
   close-issues:
     runs-on: ubuntu-latest