Lock down CI permissions

Author: kornelski

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches:

.github/workflows/semgrep.yml

@@ -7,6 +7,10 @@ on:
   schedule:
     - cron: "0 0 * * *"
 name: Semgrep config
+
+permissions:
+  contents: read
+
 jobs:
   semgrep:
     name: semgrep/ci