CI: Restrict default permissions

Reduces risk of arbitrary code is run by attacker.

Author: tacaswell

.github/workflows/check.yml

@@ -1,4 +1,6 @@
 name: "Check with pre-commit"
+permissions:
+  contents: read
 on:
   push:
     branches: ["main"]

.github/workflows/release.yml

@@ -1,4 +1,6 @@
 name: "Release"
+permissions:
+  contents: read
 on:
   release:
     types:

.github/workflows/test.yml

@@ -1,4 +1,6 @@
 name: "Test"
+permissions:
+  contents: read
 on:
   push:
     branches: ["main"]