Simplify workflow permissions to contents:read only

Based on review, all workflows can use minimal contents:read permission.
This provides the most restrictive security posture while still allowing
workflows to function properly.

Author: oschwald

.github/workflows/codeql-analysis.yml

@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: '0 13 * * 4'
 
+permissions:
+  contents: read
+
 jobs:
   CodeQL-Build:
 

.github/workflows/go.yml

@@ -2,6 +2,9 @@ name: Go
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
 
   build:

.github/workflows/golangci-lint.yml

@@ -2,6 +2,9 @@ name: golangci-lint
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   golangci:
     name: lint