Add minimal permissions blocks to GitHub Actions workflows

Address CodeQL security findings by explicitly declaring least-privilege
permissions for all workflow jobs. Jobs that only need repository checkout
get contents: read; jobs that also use the GitHub API for PR file lists
get both contents: read and pull-requests: read.

.github/workflows/build.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - uses: actions/setup-node@v6
@@ -21,6 +23,8 @@ jobs:
 
   self-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - uses: ./

.github/workflows/pull-request-verification.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - uses: actions/setup-node@v6
@@ -22,6 +24,7 @@ jobs:
   test-inline:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     steps:
     - uses: actions/checkout@v6
@@ -43,6 +46,7 @@ jobs:
   test-external:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     steps:
     - uses: actions/checkout@v6
@@ -56,6 +60,8 @@ jobs:
 
   test-without-token:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - uses: ./
@@ -69,6 +75,8 @@ jobs:
 
   test-wd-without-token:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
       with:
@@ -85,6 +93,8 @@ jobs:
 
   test-local-changes:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - run: echo "NEW FILE" > local
@@ -105,6 +115,8 @@ jobs:
 
   test-change-type:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - name: configure GIT user