add permissions for paranoid repositories to coverage report

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

.github/workflows/coverage.yaml

@@ -2,6 +2,10 @@ name: coverage
 
 on: [push]
 
+# limit default permissions to just read-only checkouts
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
@@ -48,6 +52,10 @@ jobs:
   comment:
     runs-on: ubuntu-latest
     needs: [coverage]
+    permissions:
+      # needed to add coverage comment to the pull request
+      pull-requests: write
+
     steps:
       - uses: actions/github-script@v6
         with: