ci: scope down GitHub Token permissions (#5570)

Co-authored-by: Lindsay Stewart <slindsay@amazon.com>
Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com>
Co-authored-by: maddeleine <59030281+maddeleine@users.noreply.github.com>

Author: 4 people

.github/workflows/ci_aws_kms_tls_auth.yml

@@ -9,6 +9,9 @@ on:
     types: [checks_requested]
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: rustfmt and clippy

.github/workflows/ci_freebsd.yml

@@ -9,6 +9,9 @@ on:
     types: [checks_requested]
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   testfreebsd:
     runs-on: ubuntu-latest

.github/workflows/ci_linting.yml

@@ -8,6 +8,9 @@ on:
   merge_group:
     types: [checks_requested]
     branches: [main]
+permissions:
+  contents: read
+
 jobs:
   cppcheck:
     runs-on: ubuntu-latest

.github/workflows/ci_openbsd.yml

@@ -9,6 +9,9 @@ on:
     types: [checks_requested]
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   testopenbsd:
     runs-on: ubuntu-latest

.github/workflows/ci_rust.yml

@@ -23,6 +23,9 @@ env:
   # The name of a s2n-tls test gated behind the external build cfg flag.
   EXTERNAL_BUILD_TEST_NAME: test_unstable_as_ptr
 
+permissions:
+  contents: read
+
 jobs:
   generate:
     runs-on: ${{ matrix.os }}

.github/workflows/docs.yml

@@ -9,6 +9,10 @@ on:
     types: [checks_requested]
     branches: [main]
 
+permissions:
+  contents: write
+  pages: write
+
 jobs:
   generate-doxygen:
     runs-on: ubuntu-latest

.github/workflows/gha_osx_tests.yml

@@ -10,6 +10,9 @@ on:
     types: [checks_requested]
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   OSX:
     runs-on: macos-latest

.github/workflows/policy_snapshot.yml

@@ -14,6 +14,9 @@ env:
   COMMITTED_SNAPSHOTS: ./tests/policy_snapshot/snapshots
   GENERATED_SNAPSHOTS: ./tests/policy_snapshot/generated
 
+permissions:
+  contents: read
+
 jobs:
   snapshot:
     runs-on: ubuntu-latest

.github/workflows/private_sync.yml

@@ -3,6 +3,9 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: write
+
 jobs:
   build:
     # This should only run in one place.

.github/workflows/regression_ci.yml

@@ -15,6 +15,9 @@ on:
 env:
   ROOT_PATH: bindings/rust/extended
 
+permissions:
+  contents: read
+
 jobs:
   regression-test:
     runs-on: ubuntu-latest