Add permissions declarations

.github/workflows/check-dist.yml

@@ -6,6 +6,9 @@
 # We need to make sure the checked-in `index.js` actually matches what we expect it to be.
 name: Check dist/
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/codeql-analysis.yml

@@ -1,5 +1,9 @@
 name: "Code scanning - action"
 
+permissions:
+  contents: read
+  security-events: write
+
 on:
   push:
     branches-ignore: "dependabot/**"

.github/workflows/licensed.yml

@@ -1,5 +1,8 @@
 name: Licensed
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/test.yml

@@ -7,6 +7,9 @@ on:
     paths-ignore:
       - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Build and Test