refactor: add permissions blocks to GitHub workflows for least privilege security (#4933)

* Initial plan

* feat: add permissions blocks to GitHub workflows for least privilege security

* Update default.yml

* Add pull-requests permission to workflow

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <copilot@example.com>
Co-authored-by: Maximilian Franzke <maximilian.franzke@deutschebahn.com>
Co-authored-by: Maximilian Franzke <787658+mfranzke@users.noreply.github.com>

Author: 3 people

.github/workflows/00-init.yml

@@ -1,5 +1,8 @@
 name: Init Workflow
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
 

.github/workflows/00-scan-secrets.yml

@@ -1,5 +1,8 @@
 name: Leaked Secrets Scan
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
 

.github/workflows/01-build-outputs.yml

@@ -1,6 +1,9 @@
 ---
 name: Build outputs
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
 

.github/workflows/01-build-packages.yml

@@ -1,6 +1,9 @@
 ---
 name: Build Packages
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
 

.github/workflows/01-build-patternhub.yml

@@ -1,6 +1,9 @@
 ---
 name: Build Patternhub
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/01-build-showcases.yml

@@ -1,6 +1,9 @@
 ---
 name: Build Showcases
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/01-get-playwright-version.yml

@@ -1,6 +1,9 @@
 ---
 name: 🎭 Get playwright version
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     outputs:

.github/workflows/01-get-publish-version.yml

@@ -1,6 +1,9 @@
 ---
 name: Get and save publish version
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     # Map the workflow outputs to job outputs

.github/workflows/01-init-playwright.yml

@@ -1,5 +1,8 @@
 name: 🎭 Init Playwright
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/01-lint.yml

@@ -1,5 +1,8 @@
 name: Lint
 
+permissions:
+  contents: read
+
 on:
   workflow_call: