Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR addresses OpenSSF Scorecard Token-Permissions recommendations by ensuring all GitHub workflow files have minimum required permissions.

Analysis Summary

After comprehensive analysis of all 20 workflow files, I found that the repository is already fully compliant with the security requirements. No changes were necessary.

Current State ✅

Root-Level Permissions

• ✅ 19 workflows have permissions: contents: read
• ✅ 1 workflow (ossf-scorecard.yml) has permissions: read-all
• ✅ All follow correct formatting with blank lines above and below permissions block

Job-Level Permissions

All jobs that require write permissions already have them with appropriate comments:

Regular workflow jobs:

• assign-reviewers.yml: pull-requests: write # for assigning reviewers
• backport.yml: contents: write # for Git to git push
• codeql.yml: security-events: write # for github/codeql-action/analyze to upload SARIF results
• issue-management-stale-action.yml: issues: write # for actions/stale to close stale issues
• prepare-patch-release.yml: contents: write # for Git to git push
• prepare-release-branch.yml: contents: write # for Git to git push
• release.yml: contents: write # for creating the release

Jobs calling reusable workflows:

• All reusable workflow calls in build.yml only need read permissions (already provided)
• owasp-dependency-check-daily.yml workflow notification job has correct permissions

Verification

Created and ran comprehensive validation scripts that confirmed:

• All root-level permissions follow the correct format
• All job-level permissions are appropriately scoped
• All write permissions have explanatory comments where required

The repository already implements security best practices for GitHub Actions token permissions as recommended by the OpenSSF Scorecard.

Fixes #83.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.