build: add explicit permissions to GitHub Actions workflows

This restricts the GITHUB_TOKEN to least-privilege in all workflows,
fixing CodeQL code-scanning alerts for actions/missing-workflow-permissions.

.github/workflows/build.yml

@@ -19,6 +19,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: inputs.manual || (github.repository == 'rclone/rclone' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name))

.github/workflows/build_publish_docker_image.yml

@@ -18,6 +18,10 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-image:
     if: inputs.manual || (github.repository == 'rclone/rclone' && github.event_name != 'pull_request')

.github/workflows/build_publish_docker_plugin.yml

@@ -14,6 +14,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   build_docker_volume_plugin:
     if: inputs.manual || github.repository == 'rclone/rclone'

.github/workflows/notify.yml

@@ -4,6 +4,9 @@ on:
   issues:
       types: [labeled]
 
+permissions:
+  contents: read
+
 jobs:
   notify:
     runs-on: ubuntu-latest

.github/workflows/winget.yml

@@ -3,6 +3,9 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest