ci: add read-only workflow token permissions

Set explicit, least-privilege GitHub Actions token permissions for the CI, Coverity, Doxygen, and SSL library test workflows.

The build and test jobs only need repository contents read access. The Doxygen deploy job already declares its Pages and OIDC permissions at the job level, so the workflow default can stay read-only.

Author: Alb3e3

.github/workflows/build.yaml

@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   clang-format:
     name: Check code style with clang-format

.github/workflows/coverity-scan.yml

@@ -4,6 +4,9 @@ on:
     - cron: '0 20 * * *' # Daily at 20:00 UTC
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   latest:
     # Running coverity requires the secrets.COVERITY_SCAN_TOKEN token

.github/workflows/doxygen.yml

@@ -3,6 +3,9 @@ on:
   push:
     branches: ["master"]
   workflow_dispatch:
+permissions:
+  contents: read
+
 concurrency:
   group: "pages"
   cancel-in-progress: false

.github/workflows/test-ssllib.yml

@@ -1,5 +1,8 @@
 name: test_ssllib
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs: