Fix permissions for check-run action

[mandreko-bitwarden]

Ticket

• https://bitwarden.atlassian.net/browse/VULN-252

Description

Further restrict permissions to check-run, to prevent abuse of github tokens

[github-actions]

Checkmarx One – Scan Summary & Details – b0794733-59e8-4644-bbbb-7f0cda403e36

New Issues (5)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2025-31651	Maven-org.apache.tomcat.embed:tomcat-embed-core-10.1.12	details Recommended version: 10.1.41 Description: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability was found within Apache Tomcat. For a subset of unlikely rewrite rule c... Attack Vector: NETWORK Attack Complexity: LOW ID: 4PEQzDsKk6MuPVMoBJRSj%2F2EuFgGS4BC7x7CvZ3Q3mU%3D Vulnerable Package
	CVE-2024-13009	Maven-org.eclipse.jetty:jetty-server-9.4.49.v20220914	details Recommended version: 9.4.57.v20241219 Description: In Eclipse Jetty versions 9.4.0.M0 prior to 9.4.57.v20241219, a buffer may be incorrectly released when a gzip error occurs during the inflation of... Attack Vector: NETWORK Attack Complexity: LOW ID: HTexkfRE53xuMtOE6%2BjnWDy4lyL0WaRD2aGggWyULDY%3D Vulnerable Package
	CVE-2025-1948	Maven-org.eclipse.jetty.http2:http2-common-9.4.49.v20220914	details Description: In Eclipse Jetty, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter "SETTINGS_MAX_HEADER_LIST_SIZE". The Jetty HTTP... Attack Vector: NETWORK Attack Complexity: LOW ID: mraOxV9huyiL0BSrtZADe6rlK1nOwdt7bZNHKG%2FiHrU%3D Vulnerable Package
	CVE-2025-31650	Maven-org.apache.tomcat.embed:tomcat-embed-core-10.1.12	details Recommended version: 10.1.41 Description: Improper Input Validation vulnerability was found in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in inc... Attack Vector: NETWORK Attack Complexity: LOW ID: H%2BhMlTz3P7ZiXrAivAAW8hYRtQdc2Evno%2BfUwWQbJog%3D Vulnerable Package
	CVE-2025-46701	Maven-org.apache.tomcat.embed:tomcat-embed-core-10.1.12	details Recommended version: 10.1.41 Description: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that a... Attack Vector: NETWORK Attack Complexity: LOW ID: rY7fQoi7RmCHCf73jYXr%2BLBZe5S2kF%2FA3%2F%2FYprL9gE8%3D Vulnerable Package