Add explicit permissions for GitHub workflows

Author: lesserwhirls

.github/workflows/deps.yml

@@ -1,4 +1,8 @@
-on: [pull_request]
+on:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   check-dependency-availability:

.github/workflows/docs-tutorials.yml

@@ -1,6 +1,9 @@
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check-doc-build:
     name: netCDF-Java Documentation Code Deprecation Check

.github/workflows/docs.yml

@@ -5,6 +5,9 @@ on:
       - 'docs/build.gradle'
       - 'gradle/**'
 
+permissions:
+  contents: read
+
 jobs:
   check-doc-build:
     name: netCDF-Java Documentation Build Check

.github/workflows/libaec.yml

@@ -13,6 +13,9 @@ name: libaec build using CMake on multiple platforms
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:

.github/workflows/libblosc2.yml

@@ -3,6 +3,9 @@ name: C-Blosc2 build using CMake on multiple platforms
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:

.github/workflows/style.yml

@@ -1,4 +1,8 @@
-on: [pull_request]
+on:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   check-style:

.github/workflows/test-native-compression.yml

@@ -7,6 +7,9 @@ on:
       - 'native-compression/build.gradle'
       - '.github/workflows/test-native-compression.yml'
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     strategy:

.github/workflows/tests.yml

@@ -1,4 +1,8 @@
-on: [pull_request]
+on:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   netcdf-java-tests: