gha: set default permissions to "read" only

Signed-off-by: Sebastiaan van Stijn <[email protected]>

Author: thaJeztah

.github/workflows/ci.yaml

@@ -1,5 +1,14 @@
 name: ci
 
+# Default to 'contents: read', which grants actions to read commits.
+#
+# If any permission is set, any permission not included in the list is
+# implicitly set to "none".
+#
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on: [push, pull_request]
 
 jobs: