security: Add explicit GITHUB_TOKEN permissions to all workflows

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.github/workflows/lint.yml

@@ -10,6 +10,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+    
     steps:
     - uses: actions/checkout@v4
     

.github/workflows/security.yml

@@ -12,6 +12,11 @@ jobs:
   security:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+      security-events: write  # For CodeQL
+      actions: read
+    
     steps:
     - uses: actions/checkout@v4
     

.github/workflows/test.yml

@@ -10,6 +10,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+      pull-requests: write  # For coverage comments
+    
     services:
       postgres:
         image: postgres:15