security: add permissions to GitHub Actions workflows

.github/workflows/automated_release.yaml

@@ -5,6 +5,10 @@ on:
   schedule:
     - cron: "0 10 * * 4"
 
+
+permissions:
+  contents: write
+
 jobs:
   release_management:
     uses: newrelic/coreint-automation/.github/workflows/reusable_release_automation.yaml@v3

.github/workflows/build.yml

@@ -8,6 +8,10 @@ on:
       - renovate/**
   pull_request:
 
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and scan image

.github/workflows/infra_bundle_scan_report.yml

@@ -4,6 +4,10 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and scan image

.github/workflows/nightly.yml

@@ -7,6 +7,10 @@ on:
       - master
       - main
 
+
+permissions:
+  contents: read
+
 jobs:
   nightly:
     name: Nightly standard build

.github/workflows/on-demand.yml

@@ -5,6 +5,10 @@ on:
       agent_version:
         description: "Agent version"
         required: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and push image

.github/workflows/release-windows.yml

@@ -3,6 +3,10 @@ on:
   release:
     types: [ prereleased, released ]
 
+
+permissions:
+  contents: read
+
 jobs:
   release-windows-2022:
     name: Release Windows Server 2022

.github/workflows/release.yml

@@ -3,6 +3,10 @@ on:
   release:
     types: [ prereleased, released ]
 
+
+permissions:
+  contents: read
+
 jobs:
   container-release:
     uses: newrelic/coreint-automation/.github/workflows/reusable_image_release.yaml@v3

.github/workflows/security.yml

@@ -7,6 +7,10 @@ on:
   schedule:
     - cron: "14 3 * * *" # Daily at 3:14 AM
 
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and scan image