Fix some GH action permission issues identified by CodeQL

.github/workflows/audit.yml

@@ -33,9 +33,12 @@ on:
     paths:
       - "**/Cargo.toml"
       - "**/Cargo.lock"
-  
+
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   security_audit:
     runs-on: ubuntu-latest

.github/workflows/dependencies.yml

@@ -37,6 +37,9 @@ on:
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   depcheck:
     name: circular dependency check

.github/workflows/dev.yml

@@ -85,7 +85,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
-      # Version fixed on purpose. It uses heuristics to detect typos, so upgrading 
+      # Version fixed on purpose. It uses heuristics to detect typos, so upgrading
       # it may cause checks to fail more often.
       # We can upgrade it manually once a while.
       - name: Install typos-cli

.github/workflows/docs_pr.yaml

@@ -33,8 +33,10 @@ on:
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
-
   # Test doc build
   linux-test-doc-build:
     name: Test doc build

.github/workflows/large_files.yml

@@ -25,6 +25,9 @@ on:
   pull_request:
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   check-files:
     runs-on: ubuntu-slim