ci: restrict GITHUB_TOKEN permissions in flagged workflows

.github/workflows/api-extractor.yaml

@@ -12,6 +12,9 @@ on:
             - release/**
     pull_request:
 
+permissions:
+    contents: read
+
 concurrency:
     group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
     cancel-in-progress: true

.github/workflows/bump-version-pr.yaml

@@ -9,6 +9,10 @@ on:
 jobs:
     bump:
         runs-on: ubuntu-latest
+        # create-pull-request pushes a branch and opens the PR
+        permissions:
+            contents: write
+            pull-requests: write
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/main.yml

@@ -156,6 +156,8 @@ jobs:
         name: Integration Tests
         runs-on: ubuntu-latest
         needs: [code-quality-and-tests]
+        permissions:
+            contents: read
         if: |
             (github.event_name == 'workflow_dispatch' && inputs.enforce_full_run) ||
             github.ref == 'refs/heads/main' ||