ci: add minimum GitHub token permissions for workflows

[ashishkurmi]

Description

This PR adds minimum token permissions for the GITHUB_TOKEN in GitHub Actions workflows using https://github.com/step-security/secure-workflows.

The GitHub Actions workflow has a GITHUB_TOKEN with write access to multiple scopes. Here is an example of the permissions in one of the workflow runs: https://github.com/python/mypy/runs/8253080028?check_suite_focus=true#step:1:19

After this change, the scopes will be reduced to the minimum needed for the following workflows:

• build_wheels.yml
• docs.yml
• mypy_primer.yml
• test.yml
• test_stubgenc.yml

The following workflow already has the least privileged token permission set:

• mypy_primer_comment.yml

Motivation and Context

• This is a security best practice, so if the GITHUB_TOKEN is compromised due to a vulnerability or compromised Action, the damage will be reduced.
• GitHub recommends defining minimum GITHUB_TOKEN permissions. https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
• The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue. This change will help increase the Scorecard score for this repository.

Signed-off-by: Ashish Kurmi [email protected]

[github-actions[bot]]

According to mypy_primer, this change has no effect on the checked open source code. 🤖🎉

[ashishkurmi]

Thanks for reviewing the PR @sobolevn ! I just addressed your comment, please take a look when you get a chance.