VLN-492: Set explicit permissions for GitHub Actions workflows (#1199)

* Set explicit permissions for GitHub Actions workflows

This change was made by an automated process to ensure all GitHub Actions workflows have explicitly defined permissions as per best practices.

* Add `actions: read` to use `temporalio/features`

Following the same fix done here:
temporalio/sdk-dotnet#556

After this was landed:
temporalio/features#693

Author: picatz

.github/workflows/build-binaries.yml

@@ -5,6 +5,9 @@ on:
       - main
       - "releases/*"
 
+permissions:
+  contents: read
+
 jobs:
   # Compile the binaries and upload artifacts
   compile-binaries:

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
       - main
       - "releases/*"
 
+permissions:
+  contents: read
+  actions: read
+
 env:
   COLUMNS: 120
 

.github/workflows/nightly-throughput-stress.yml

@@ -26,7 +26,7 @@ on:
         type: number
 
 permissions:
-    contents: read
+  contents: read
 
 env:
   # Workflow configuration
@@ -173,4 +173,4 @@ jobs:
               ]
             }
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SDK_ALERTS_WEBHOOK }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SDK_ALERTS_WEBHOOK }}

.github/workflows/nightly.yml

@@ -5,6 +5,9 @@ on:
     # (12 AM PST)
     - cron: "00 07 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   nightly:
     uses: ./.github/workflows/run-bench.yml

.github/workflows/omes.yml

@@ -5,6 +5,10 @@ on:
       - main
       - "releases/*"
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   omes-image-build:
     uses: temporalio/omes/.github/workflows/docker-images.yml@main

.github/workflows/run-bench.yml

@@ -18,6 +18,9 @@ on:
           - "--sandbox"
           - "--no-sandbox"
 
+permissions:
+  contents: read
+
 jobs:
   run-bench:
     strategy:
@@ -68,4 +71,4 @@ jobs:
       - run: poe run-bench --workflow-count 10000 --max-cached-workflows 10000 --max-concurrent 10000 ${{ inputs.sandbox-arg }}
 
       - run: poe run-bench --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000 ${{ inputs.sandbox-arg }}
-      - run: poe run-bench --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000 ${{ inputs.sandbox-arg }}
+      - run: poe run-bench --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000 ${{ inputs.sandbox-arg }}