SEC: disable default gha permissions (#2771)

.github/workflows/release.yml

@@ -7,6 +7,8 @@ on:
     types:
     - published
 
+permissions: {}
+
 jobs:
   dist:
     runs-on: ubuntu-latest

.github/workflows/test.yml

@@ -28,6 +28,8 @@ on:
   workflow_dispatch:
     # allow manual runs on branches without a PR
 
+permissions: {}
+
 concurrency:
   group: test-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/update-dependencies.yml

@@ -14,11 +14,15 @@ on:
   schedule:
     - cron: '0 6 * * 1'  # "At 06:00 on Monday."
 
+permissions: {}
+
 jobs:
   update-dependencies:
     name: Update dependencies
     if: github.repository_owner == 'pypa' || github.event_name != 'schedule'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
 
     # we use this step to grab a Github App auth token, so that PRs generated by this workflow