workflows: Restrict GitHub permissions.

Signed-off-by: Anders Kaseorg <anders@zulip.com>

Author: andersk

.github/workflows/zulip-ci.yml

@@ -7,6 +7,9 @@ name: Zulip server CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash

.github/workflows/zulip-tests.yml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   static-analysis:
     runs-on: ubuntu-latest