explicitly set permissions for github actions (#687)

Signed-off-by: Kenny Leung <kleung@chainguard.dev>

.github/workflows/codeql-analysis.yml

@@ -24,6 +24,10 @@ on:
   schedule:
     - cron: '45 10 * * 1'
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/main.yml

@@ -21,6 +21,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04

.github/workflows/verify.yml

@@ -17,6 +17,9 @@ name: Verify
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   license-check:
     name: license boilerplate check