chore(ci): set explicit least-privilege workflow permissions (#14809)

.github/workflows/ci.yml

@@ -10,6 +10,9 @@ on:
       - main
       - minor
 
+permissions:
+  contents: read
+
 jobs:
   test:
     if: ${{ ! startsWith(github.event.head_commit.message, 'release:') && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository) }}

.github/workflows/ecosystem-ci-trigger.yml

@@ -4,6 +4,11 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
 jobs:
   trigger:
     runs-on: ubuntu-latest