ci: Limit token permissions

Also fixed whitespace issues in `.github/workflows`.

Author: ValuedMammal

.github/workflows/audit.yml

@@ -10,23 +10,23 @@ on:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
   schedule:
-    # weekly
-    - cron: '0 0 * * 0'
+    - cron: '0 0 * * 0' # At 00:00 on Sunday
   workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
 
-permissions:
-  contents: read
-  security-events: write   
-  issues: write            
+permissions: {}
 
 jobs:
   cargo-audit:
     name: RustSec Audit (vulnerabilities)
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+      issues: write
 
     steps:
       - name: Checkout code

.github/workflows/cont_integration.yml

@@ -2,6 +2,8 @@ on: [push, pull_request]
 
 name: CI
 
+permissions: {}
+
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
@@ -21,7 +23,7 @@ jobs:
           toolchain: stable
           components: rustfmt
           cache: true
-      
+
       - name: Check fmt
         run: cargo fmt --all -- --check
 
@@ -37,7 +39,7 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
-          persist-credentials: false      
+          persist-credentials: false
       - name: Install Rust toolchain
         uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
         with:
@@ -61,19 +63,19 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
-          persist-credentials: false      
+          persist-credentials: false
       - name: Install Rust toolchain
         uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
         with:
           toolchain: stable
           cache: true
-      
+
       - name: Build
         run: cargo build ${{ matrix.features }} --verbose
-      
+
       - name: Run unit tests
         run: cargo test ${{ matrix.features }} --lib --verbose
-      
+
       - name: Run doc tests
         run: cargo test ${{ matrix.features }} --doc --verbose
 
@@ -84,12 +86,12 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
-          persist-credentials: false      
+          persist-credentials: false
       - name: Install Rust toolchain
         uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
         with:
           toolchain: 1.75.0
           cache: true
-          
+
       - name: Check MSRV
         run: cargo check --all-features

.github/workflows/zizmor.yml

@@ -1,28 +1,30 @@
 name: GitHub Actions Security Analysis with zizmor
 
 on:
-  pull_request:                  
+  pull_request:
+    branches: ["**"]
+  push:
     branches: ["**"]
-  push:                          
-    branches: ["**"]             
   schedule:
-    - cron: '0 0 * * 0'          
-  workflow_dispatch:            
+    - cron: '0 0 * * 0' # At 00:00 on Sunday
+  workflow_dispatch:
 
-permissions:
-  contents: read
-  security-events: write         
+permissions: {}
 
 jobs:
   zizmor:
     name: zizmor security scan
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
           persist-credentials: false
 
-      - name: Run zizmor 
-        uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95  
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95