GH: explicitly set permissions in workflows

These will override the default repo/org GITHUB_TOKEN scope.

.github/workflows/buildbot.yml

@@ -6,6 +6,9 @@ on:
       - master
       - 'stable-1.*'
 
+permissions:
+  contents: read
+
 jobs:
   buildbot:
     uses: nginx/ci-self-hosted/.github/workflows/nginx-buildbot.yml@main

.github/workflows/check-commit-message.yaml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [ opened, synchronize ]
 
+permissions:
+  contents: read
+
 jobs:
   check-commit-messages:
     runs-on: ubuntu-24.04

.github/workflows/check-pr.yml

@@ -3,6 +3,10 @@ name: check-pr
 on:
   pull_request:
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   check-pr:
     uses: nginx/ci-self-hosted/.github/workflows/nginx-check-pr.yml@main

.github/workflows/check-version-bump.yaml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [ opened, synchronize ]
 
+permissions:
+  contents: read
+
 jobs:
   check-version-bump:
     runs-on: ubuntu-24.04

.github/workflows/check-whitespace.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     types: [ opened, synchronize ]
 
+permissions:
+  contents: read
+
 jobs:
   check-whitespace:
     runs-on: ubuntu-24.04