set workflows permissions to read-only (#7239)

.github/workflows/build.yml

@@ -1,4 +1,5 @@
 name: CI
+permissions: read-all
 
 on:
   push:

.github/workflows/codeql.yml

@@ -10,6 +10,7 @@
 # supported CodeQL languages.
 #
 name: "CodeQL"
+permissions: read-all
 
 on:
   push:

.github/workflows/label.yml

@@ -6,6 +6,8 @@
 # https://github.com/actions/labeler
 
 name: Labeler
+permissions: read-all
+
 on: [pull_request_target]
 
 jobs:

.github/workflows/main.yml

@@ -1,4 +1,6 @@
 name: OSS-Fuzz
+permissions: read-all
+
 on: 
   pull_request:
     branches:

.github/workflows/stale.yml

@@ -1,4 +1,5 @@
 name: Mark stale issues and pull requests
+permissions: read-all
 
 on:
   schedule: