gha: set default permissions to "read"

Signed-off-by: Sebastiaan van Stijn <[email protected]>

Author: thaJeztah

.github/workflows/test.yml

@@ -1,4 +1,14 @@
 name: Test
+
+# Default to 'contents: read', which grants actions to read commits.
+#
+# If any permission is set, any permission not included in the list is
+# implicitly set to "none".
+#
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on: [push, pull_request]
 jobs:
   test: