ci: set explicit token permissions (#3225)

.github/workflows/backport.yaml

@@ -1,4 +1,6 @@
 name: Backport
+permissions:
+  contents: read
 on:
   pull_request_target:
     types:

.github/workflows/docker-main.yaml

@@ -1,4 +1,6 @@
 name: Docker Main
+permissions:
+  contents: read
 on:
   push:
     branches:

.github/workflows/release.yaml

@@ -1,4 +1,6 @@
 name: Release
+permissions:
+  contents: read
 
 on:
   release:
@@ -7,6 +9,10 @@ on:
 
 jobs:
   goreleaser:
+    permissions:
+      contents: write
+      issues: read
+      pull-requests: read
     runs-on: ubuntu-latest
     env:
       DOCKER_CLI_EXPERIMENTAL: "enabled"

.github/workflows/test.yaml

@@ -1,10 +1,12 @@
+name: Test
+permissions:
+  contents: read
 on:
   push:
     branches:
       - main
   pull_request:
 
-name: Test
 jobs:
   test:
     strategy: