Scope GITHUB_TOKEN permissions per job (#480)

A job with no `permissions:` block inherits whatever the repository
hands out. Each block added here grants what that job's own steps
need and nothing more.

Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>

Author: hf-security-analysis[bot]

.github/workflows/ci.buld.yml

@@ -2,8 +2,12 @@ name: Run tests and build
 
 on: [push]    
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     steps:
@@ -34,6 +38,8 @@ jobs:
 
 
   docker:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     needs: build