chore: restrict GitHub workflow permissions - future-proof

Signed-off-by: Melissa Kilby <mkilby@apple.com>

Author: incertum

.github/workflows/build-esp.yml

@@ -1,5 +1,8 @@
 name: ESP
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]

.github/workflows/build-nuttx.yml

@@ -1,5 +1,8 @@
 name: NuttX
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]

.github/workflows/build-rpi-baremetal.yml

@@ -1,5 +1,8 @@
 name: Raspberry Pi Baremetal
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]

.github/workflows/build-rpi-pico-sdk.yml

@@ -1,5 +1,8 @@
 name: Raspberry Pi Pico SDK
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]

.github/workflows/build-stm32-elf.yml

@@ -1,5 +1,8 @@
 name: STM32 ELF
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]

.github/workflows/build-stm32-macho.yml

@@ -1,5 +1,8 @@
 name: STM32 Macho
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]

.github/workflows/build-zephyr.yml

@@ -1,5 +1,8 @@
 name: Zephyr
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]

.github/workflows/lint.yml

@@ -1,5 +1,8 @@
 name: Lint
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]

.github/workflows/update-swift-version.yml

@@ -1,5 +1,8 @@
 name: Update Swift Version
 
+permissions:
+  contents: read
+
 on:
   schedule:
     - cron: '0 0 */7 * *'  # Every 7 days at midnight UTC