Fix #891: add default workflow permissions (#898)

Author: mhucka

.github/workflows/ci-build-checks.yaml

@@ -24,6 +24,8 @@ on:
     types:
       - checks_requested
 
+permissions: read-all
+
 jobs:
   wheel-build:
     name: Wheel test

.github/workflows/ci-file-checks.yaml

@@ -83,6 +83,8 @@ concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+permissions: read-all
+
 jobs:
   Changes:
     runs-on: ubuntu-24.04

.github/workflows/ci-nightly-build-test.yaml

@@ -69,6 +69,8 @@ concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+permissions: read-all
+
 jobs:
   Decision:
     runs-on: ubuntu-24.04

.github/workflows/ci-nightly-cirq-test.yaml

@@ -83,6 +83,8 @@ concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+permissions: read-all
+
 jobs:
   test-compatibility:
     name: Run TFQ tests