ci: add minimum GitHub token permissions for workflow

[ashishkurmi]

Description

This PR adds minimum token permissions for the GITHUB_TOKEN in GitHub Actions workflows using secure-workflows.

The GitHub Actions workflow has a GITHUB_TOKEN with write access to multiple scopes. Here is an example of the permissions in one of the workflow runs:
https://github.com/qt/qtbase/actions/runs/3168920282/jobs/5160466776#step:1:19

After this change, the scopes will be reduced to the minimum needed for the following workflow:

• ninja-build.yml

Motivation and Context

• This is a security best practice, so if the GITHUB_TOKEN is compromised due to a vulnerability or compromised Action, the damage will be reduced.
• GitHub recommends defining minimum GITHUB_TOKEN permissions.
• The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue. This change will help increase the Scorecard score for this repository.

Signed-off-by: Ashish Kurmi [email protected]

[jonaski]

Qt doesn't use GitHub, this needs to be submitted to Gerrit codereview (https://codereview.qt-project.org/). For instructions see: https://wiki.qt.io/Setting_up_Gerrit and https://wiki.qt.io/Gerrit_Introduction

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}