[CI] gha: set default workflow permissions (#1976)

Author: jbampton

.github/workflows/docs.yml

@@ -26,6 +26,9 @@ on:
     branches:
       - '*'
 
+permissions:
+  contents: read
+
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
 

.github/workflows/first-interaction.yml

@@ -23,6 +23,9 @@ on:
   pull_request:
     types: [opened]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

.github/workflows/pyflink.yml

@@ -39,6 +39,9 @@ on:
       - 'python/**'
       - '.github/workflows/pyflink.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/python-wheel.yml

@@ -39,6 +39,9 @@ on:
       - 'python/**'
       - '.github/workflows/python-wheel.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

.github/workflows/r.yml

@@ -39,6 +39,9 @@ on:
       - 'R/**'
       - '.github/workflows/r.yml'
 
+permissions:
+  contents: read
+
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
   DO_NOT_TRACK: true