ci: add empty permissions to all umbrella jobs (CodeQL)

Signed-off-by: danbugs <danilochiarlone@gmail.com>

Author: danbugs

.github/workflows/benchmarks.yml

@@ -449,6 +449,7 @@ jobs:
     if: always()
     needs: [build-image, bench-linux, bench-windows]
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - run: |
           results=("${{ needs.build-image.result }}" "${{ needs.bench-linux.result }}" "${{ needs.bench-windows.result }}")

.github/workflows/host-checks.yml

@@ -78,6 +78,7 @@ jobs:
     if: always()
     needs: [checks]
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - run: |
           results=("${{ needs.checks.result }}")

.github/workflows/test-examples.yml

@@ -748,6 +748,7 @@ jobs:
     if: always()
     needs: [build-example, runtime-test, package-images-for-windows, runtime-test-windows, pyhl-snapshot-test]
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - run: |
           results=("${{ needs.build-example.result }}" "${{ needs.runtime-test.result }}" "${{ needs.package-images-for-windows.result }}" "${{ needs.runtime-test-windows.result }}" "${{ needs.pyhl-snapshot-test.result }}")