fix(ci): restrict default workflow token permissions

Author: lepture

.github/workflows/docs.yml

@@ -13,6 +13,9 @@ on:
       - ".github/*"
       - "tests/*"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/pypi.yml

@@ -5,6 +5,9 @@ on:
     tags:
     - "1.*"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: build dist files

.github/workflows/test.yml

@@ -21,6 +21,9 @@ on:
       - '*.lock'
 
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest