Scope down workflow permissions

.github/workflows/benchmark-linux.yml

@@ -1,13 +1,13 @@
 name: facebook/rocksdb/benchmark-linux
-# FIXME: Disabled temporarily
-# on:
-#   schedule:
-#   - cron: 7 */2 * * *  # At minute 7 past every 2nd hour
-
+on: workflow_dispatch
+permissions: {}
+  # FIXME: Disabled temporarily
+  # schedule:
+  # - cron: 7 */2 * * *  # At minute 7 past every 2nd hour
 jobs:
   benchmark-linux:
     if: ${{ github.repository_owner == 'facebook' }}
-    runs-on: self-hosted
+    runs-on: ubuntu-latest # FIXME: change this back to self-hosted when ready
     steps:
     - uses: actions/checkout@v4.1.0
     - uses: "./.github/actions/build-for-benchmarks"

.github/workflows/nightly-candidate.yml

@@ -1,5 +1,6 @@
 name: facebook/rocksdb/nightly
 on: workflow_dispatch
+permissions: {}
 jobs:
   # These jobs would be in nightly but are failing or otherwise broken for
   # some reason.

.github/workflows/nightly.yml

@@ -3,6 +3,7 @@ on:
   schedule:
   - cron: 0 9 * * *
   workflow_dispatch:
+permissions: {}
 jobs:
   build-format-compatible:
     if: ${{ github.repository_owner == 'facebook' }}

.github/workflows/pr-jobs-candidate.yml

@@ -1,5 +1,6 @@
 name: facebook/rocksdb/pr-jobs-candidate
 on: workflow_dispatch
+permissions: {}
 jobs:
   # These jobs would be in pr-jobs but are failing or otherwise broken for
   # some reason.

.github/workflows/pr-jobs.yml

@@ -1,5 +1,6 @@
 name: facebook/rocksdb/pr-jobs
 on: [push, pull_request]
+permissions: {}
 jobs:
   # NOTE: multiple workflows would be recommended, but the current GHA UI in
   # PRs doesn't make it clear when there's an overall error with a workflow,