fix(ci): add least-privilege permissions to workflow files (#2944)

Signed-off-by: Vibhav Bobade <vibhav.bobde@gmail.com>

Author: waveywaves

.github/workflows/build_external_container_images.yaml

@@ -5,12 +5,14 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   build_and_push_images:
     name: Build and Push ${{ matrix.image.name }} Image
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         image:

.github/workflows/codeql.yml

@@ -11,7 +11,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write # required for SLSA attestation
 
 jobs:
   analyze:

.github/workflows/stale.yml

@@ -5,6 +5,10 @@ on:
     - cron: '30 1 * * *'
   workflow_dispatch:
 
+# Job-level permissions completely replace workflow-level defaults, so the
+# token only receives the job's issues: write + pull-requests: write grants.
+permissions: {}
+
 jobs:
   close-issues:
     runs-on: ubuntu-latest