[actions] add minimum GitHub token permissions for workflows

[varunsh-coder]

Description

This PR adds minimum token permissions for the GITHUB_TOKEN in GitHub Actions workflows using https://github.com/step-security/secure-workflows.

GitHub Actions workflows have a GITHUB_TOKEN with write access to multiple scopes.
After this change, the scopes will be reduced to the minimum needed for each workflow.

Motivation and Context

• This is a security best practice, so if the GITHUB_TOKEN is compromised due to a vulnerability or compromised Action, the damage will be reduced.
• GitHub recommends defining minimum GITHUB_TOKEN permissions.
  https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
• The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue. This change will help increase the Scorecard score for this repository.

Signed-off-by: Varun Sharma [email protected]

[ljharb]

Thanks!

[codecov]

Codecov Report

Base: 95.23% // Head: 95.23% // No change to project coverage 👍

Coverage data is based on head (753505d) compared to base (cf9313c).
Patch has no changes to coverable lines.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2547   +/-   ##
=======================================
  Coverage   95.23%   95.23%           
=======================================
  Files          67       67           
  Lines        2917     2917           
  Branches      989      989           
=======================================
  Hits         2778     2778           
  Misses        139      139           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.