chore: restrict GitHub workflow permissions - future-proof

.github/workflows/ci-prb.yml

@@ -1,4 +1,6 @@
 name: PR Builder
+permissions:
+  contents: read
 on:
   pull_request:
     branches: [ main ]

.github/workflows/ci-release-docs.yml

@@ -1,10 +1,9 @@
 name: Doc Builder
+permissions:
+  contents: read
 on:
   release:
     types: [published]
-permissions:
-  pages: write
-  id-token: write
 jobs:
   build:
     name: Python Doc Builder
@@ -29,6 +28,9 @@ jobs:
       with:
         path: _build
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/ci-release.yml

@@ -1,4 +1,6 @@
 name: Release Builder
+permissions:
+  contents: read
 on:
   release:
     types: [published]

.github/workflows/ci-snapshot.yml

@@ -1,4 +1,6 @@
 name: Snapshot Builder
+permissions:
+  contents: read
 on:
   release:
     types: [published]