[actions] set proper permissions

Author: ljharb

.github/workflows/executable.yml

@@ -2,6 +2,8 @@ name: resolve executable
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   _:
     name: cli

.github/workflows/node-aught.yml

@@ -2,6 +2,8 @@ name: 'Tests: node.js < 10'
 
 on: [pull_request, push]
 
+permissions: read-all
+
 jobs:
   tests:
     uses: ljharb/actions/.github/workflows/node.yml@main

.github/workflows/node-pretest.yml

@@ -2,6 +2,8 @@ name: 'Tests: pretest/posttest'
 
 on: [pull_request, push]
 
+permissions: read-all
+
 jobs:
   tests:
     uses: ljharb/actions/.github/workflows/pretest.yml@main

.github/workflows/node-tens.yml

@@ -2,8 +2,7 @@ name: 'Tests: node.js 10 - 20'
 
 on: [pull_request, push]
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   tests:

.github/workflows/node-twenties.yml

@@ -2,8 +2,7 @@ name: 'Tests: node.js >= 20'
 
 on: [pull_request, push]
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   tests:

.github/workflows/rebase.yml

@@ -2,6 +2,10 @@ name: Automatic Rebase
 
 on: [pull_request_target]
 
+permissions:
+  contents: write  # for ljharb/rebase to push code to rebase
+  pull-requests: read  # for ljharb/rebase to get info about PR
+
 jobs:
   _:
     uses: ljharb/actions/.github/workflows/rebase.yml@main

.github/workflows/require-allow-edits.yml

@@ -2,6 +2,8 @@ name: Require “Allow Edits”
 
 on: [pull_request_target]
 
+permissions: read-all
+
 jobs:
   _:
     name: "Require “Allow Edits”"