Add explicit permissions to CI workflow jobs

.github/workflows/ci.yml

@@ -18,6 +18,8 @@ jobs:
   format:
     name: Format
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
@@ -33,6 +35,9 @@ jobs:
     name: Clippy
     runs-on: ubuntu-latest
     needs: format
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v4
 
@@ -51,6 +56,8 @@ jobs:
     name: REUSE Compliance
     runs-on: ubuntu-latest
     needs: clippy
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
@@ -61,6 +68,8 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     needs: reuse
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
@@ -86,6 +95,9 @@ jobs:
     name: Test
     runs-on: ${{ matrix.os }}
     needs: audit
+    permissions:
+      contents: read
+      actions: write
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
@@ -138,6 +150,9 @@ jobs:
     name: Coverage
     runs-on: ubuntu-latest
     needs: test
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v4
 
@@ -165,6 +180,9 @@ jobs:
     name: Documentation
     runs-on: ubuntu-latest
     needs: format
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v4
 
@@ -181,6 +199,9 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     needs: format
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v4
 
@@ -197,6 +218,9 @@ jobs:
     name: Benchmark
     runs-on: ubuntu-latest
     needs: format
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v4