chore(ci): limit GITHUB_TOKEN to read-only in ten workflows

.github/workflows/deploy-to-app.yaml

@@ -1,5 +1,7 @@
 # App deployments are non-production deployments to mainnet.  They are public, can be used as staging, but e.g. funds are real.
 name: Deploy to app
+permissions:
+  contents: read
 on:
   push:
     branches:

.github/workflows/docker-main.yaml

@@ -1,4 +1,6 @@
 name: Populate docker cache
+permissions:
+  contents: read
 on:
   push:
     branches:

.github/workflows/reproducible.yaml

@@ -4,6 +4,8 @@ name: Reproducible Docker Builds
 #   Note: This makes builds slow but is more representative of the end user experience.
 # - NOT DONE: Verify that these builds match our release artifacts.  This would correspond to third
 #   party verifiers getting consistent hashes that differ from our release.
+permissions:
+  contents: read
 on:
   push:
     branches:

.github/workflows/update-aggregator.yml

@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly updates the aggregator SNS parsing code
 # and creates a PR for any changes.
 name: Update sns_aggregator candid bindings
+permissions:
+  contents: read
 on:
   schedule:
     # Check for updates on candid interface for the aggregator every monday at 3:30am.

.github/workflows/update-didc.yml

@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly checks for new `didc` releases
 # and creates a PR on new versions.
 name: didc Update
+permissions:
+  contents: read
 on:
   schedule:
     # check for new `didc` releases every tuesday at 7:30.

.github/workflows/update-ic-cargo-deps.yaml

@@ -1,5 +1,7 @@
 # A GitHub Actions workflow that regularly checks for new `ic` releases and updates the Cargo.toml dependencies.
 name: Update IC Cargo Dependencies
+permissions:
+  contents: read
 on:
   schedule:
     # Check for new IC releases every Sunday at 7:30am UTC.

.github/workflows/update-next.yml

@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that can be used to trigger updates of npm package
 # dependencies.
 name: Update next npm package dependencies
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:

.github/workflows/update-rust.yml

@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly checks for new Rust toolchain release
 # and creates a PR on new versions.
 name: Update rust
+permissions:
+  contents: read
 on:
   schedule:
     # check for new rust versions weekly

.github/workflows/update-sns-aggregator-response.yml

@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly fetches the production response
 # of the SNS aggregator and updates the mock files for the ProdLaunchpad.spec test.
 name: Update the SNS aggregator response for ProdLaunchpad.spec
+permissions:
+  contents: read
 on:
   schedule:
     - cron: "30 3 * * THU"

.github/workflows/update-snsdemo.yml

@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly checks for new snsdemo commits
 # and creates a PR on finding any.
 name: Update snsdemo
+permissions:
+  contents: read
 on:
   schedule:
     # check for new snsdemo commits weekly