ci: add read-only workflow token permissions and fix template injection

All four workflows lacked a top-level permissions block, so they
inherited the repository default, which can be write-all on permissive
settings.

- build.yaml, coverity-scan.yml, doxygen.yml: add `permissions: read-all`
  at the workflow level.  The doxygen deploy job retains its existing
  job-level `pages: write` and `id-token: write` overrides, which take
  precedence for that job only.
- test-ssllib.yml: add `permissions: read-all` and replace seven direct
  `${{inputs.*}}` template expansions inside `run:` blocks with env-var
  references (LIB_CONFIGURE, LIB_MAKE, LIB_INSTALL, OVPN_LIBNAME,
  OVPN_CONFIGURE_FLAGS, OVPN_LIBDESC, OVPN_CONFIGURE_ENV) to eliminate
  the zizmor template-injection findings.  The configure prefix that sets
  crypto-library env vars is now passed through `env -S` instead of direct
  interpolation, preserving behaviour while avoiding shell-injection risk.

Verified with zizmor --min-severity medium: 0 high-severity findings
after this patch (down from 9).

Signed-off-by: Alb3e3 <tomaska.filip@gmail.com>

Author: ftmska

.github/workflows/build.yaml

@@ -4,6 +4,8 @@ on:
   push:
   pull_request:
 
+permissions: read-all
+
 jobs:
   clang-format:
     name: Check code style with clang-format

.github/workflows/coverity-scan.yml

@@ -4,6 +4,8 @@ on:
     - cron: '0 20 * * *' # Daily at 20:00 UTC
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   latest:
     # Running coverity requires the secrets.COVERITY_SCAN_TOKEN token

.github/workflows/doxygen.yml

@@ -3,6 +3,8 @@ on:
   push:
     branches: ["master"]
   workflow_dispatch:
+permissions: read-all
+
 concurrency:
   group: "pages"
   cancel-in-progress: false

.github/workflows/test-ssllib.yml

@@ -1,5 +1,7 @@
 name: test_ssllib
 
+permissions: read-all
+
 on:
   workflow_call:
     inputs:
@@ -65,6 +67,13 @@ jobs:
       CXX: ${{matrix.cxx}}
       UBSAN_OPTIONS: print_stacktrace=1
       LIBPREFIX: /opt/${{inputs.libname}}
+      LIB_CONFIGURE: ${{inputs.libconfigure}}
+      LIB_MAKE: ${{inputs.libmake}}
+      LIB_INSTALL: ${{inputs.libinstall}}
+      OVPN_LIBNAME: ${{inputs.ovpnlibname}}
+      OVPN_CONFIGURE_FLAGS: ${{inputs.ovpnconfigureflags}}
+      OVPN_LIBDESC: ${{inputs.ovpnlibdesc}}
+      OVPN_CONFIGURE_ENV: ${{inputs.ovpnconfigureenv}}
 
     steps:
       - name: Install dependencies
@@ -85,15 +94,15 @@ jobs:
           ref: ${{inputs.gitref}}
       - name: "${{inputs.libname}}: configure"
         if: steps.ssllib-cache.outputs.cache-hit != 'true'
-        run: ${{inputs.libconfigure}}
+        run: $LIB_CONFIGURE
         working-directory: ${{inputs.libname}}
       - name: "${{inputs.libname}}: build"
         if: steps.ssllib-cache.outputs.cache-hit != 'true'
-        run: ${{inputs.libmake}}
+        run: $LIB_MAKE
         working-directory: ${{inputs.libname}}
       - name: "${{inputs.libname}}: install"
         if: steps.ssllib-cache.outputs.cache-hit != 'true'
-        run: ${{inputs.libinstall}}
+        run: $LIB_INSTALL
         working-directory: ${{inputs.libname}}
       - name: Run ldconfig
         run: sudo ldconfig
@@ -103,14 +112,14 @@ jobs:
         run: autoreconf -fvi
       - name: "OpenVPN: configure"
         run: |
-          ${{inputs.ovpnconfigureenv}} \
-          ./configure --with-crypto-library=${{inputs.ovpnlibname}} ${{inputs.ovpnconfigureflags}}
+          env -S "$OVPN_CONFIGURE_ENV" \
+          ./configure --with-crypto-library=$OVPN_LIBNAME $OVPN_CONFIGURE_FLAGS
       - name: "OpenVPN: build"
         run: make -j3
       - name: Ensure the build uses ${{inputs.libname}}
         run: |
           ./src/openvpn/openvpn --version
-          ./src/openvpn/openvpn --version | grep -q "library versions: ${{inputs.ovpnlibdesc}}"
+          ./src/openvpn/openvpn --version | grep -q "library versions: $OVPN_LIBDESC"
       - name: "OpenVPN: configure checks"
         run: echo 'RUN_SUDO="sudo -E"' >tests/t_server_null.rc
       - name: "OpenVPN: make check"