GH Actions: set permissions for each workflow/job

[jrfnl]

Users frequently over-scope their workflow and job permissions, or set broad workflow-level permissions without realizing that all jobs inherit those permissions.

Furthermore, users often don't realize that the default GITHUB_TOKEN permissions can be very broad, meaning that workflows that don't configure any permissions at all can still provide excessive credentials to their individual jobs.

Remediation
In general, permissions should be declared as minimally as possible, and as close to their usage site as possible.

In practice, this means that workflows should almost always set permissions: {} at the workflow level to disable all permissions by default, and then set specific job-level permissions as needed.

Refs:

• https://docs.zizmor.sh/audits/#excessive-permissions

Notes:

• Includes a few minor tweaks for consistency in the instructions order.
• The permissions added are based on an best effort to discover the ones needed. Some tweaking may still be needed.

---

@antecedent And while looking at the workflows to create this PR, I noticed the following:

1. The regenerate-pages job in the release.yml workflow seems kind of useless as it doesn't do anything other than checkout the branch and create an empty commit. What is that job supposed to do ?
   Looking at the website, the changelog page feels painfully out of date.
2. For the PHAR releases it would probably be a good idea to enable creating attestations (SLSA). It would only take a small tweak to the bundle job to enable that.

[antecedent]

@jrfnl: I believe that regenerate-pages was supposed to be my starting point for implementing the things that you describe: auto-updating the changelog and bumping the version number on the home page. I never got to any of that, though. For the time being, I could replace the changelog page with a link to the list of releases on GitHub.

As for the artifact attestations, thank you for bringing them to my attention; I will take a look.

[jrfnl]

@jrfnl: I believe that regenerate-pages was supposed to be my starting point for implementing the things that you describe: auto-updating the changelog and bumping the version number on the home page. I never got to any of that, though. For the time being, I could replace the changelog page with a link to the list of releases on GitHub.

I see. Want me to have a look at this when I find some time ?