Tighten GITHUB_TOKEN scope on bandit, codeql, publish, python workflows

OSSF Scorecard's token-permissions check was scoring 0. Default
GITHUB_TOKEN scope is write, so workflows that don't declare permissions
inherit too much. scorecard.yml was already locked down; the other four
weren't.

Top-level read-all on each, with the write bits scoped to the jobs that
actually need them:
- bandit.yml: analyze keeps security-events: write
- codeql.yml: analyze keeps security-events: write plus actions/contents: read
- publish.yml: publish keeps id-token: write for PyPI OIDC
- python.yml: build keeps pull-requests: write for the coverage comment

Author: timlnx

.github/workflows/bandit.yml

@@ -10,6 +10,8 @@ on:
     - cron: "0 0 * * 0"
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   analyze:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -8,6 +8,8 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
+permissions: read-all
+
 jobs:
   analyze:
     name: Analyze Python

.github/workflows/publish.yml

@@ -4,6 +4,8 @@ on:
   release:
     types: [published]
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/python.yml

@@ -2,6 +2,8 @@ name: Python CI
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   build:
     permissions: