Set minimum permissions to workflows

[gabibguti]

Setting minimum permissions to workflows is important to keep your repository safe against supply-chain attacks. GitHub grants a GITHUB_TOKEN with higher permissions than necessary by default for workflows. With higher permissions, if your workflow suffers an attack, the attacker would be able to push malicious code to your repository for example. To avoid that, we set minimum permissions.

I see both workflows, fossa.yaml and go.yml, don't need much permissions, so setting contents: read should be enough. If you agree with the changes, I can open a PR!

This is considered good-practice and recommended by GitHub and other security tools, such as Scorecards and StepSecurity.

Additional context

I'm Gabriela and I work on behalf of Google and the OpenSSF suggesting supply-chain security changes :)

[abhinav]

Thanks, @gabibguti!
We'll make the change.