build: be explicit about actions only having permission to read contents

Author: nedbat

.github/workflows/coverage.yml

@@ -19,6 +19,9 @@ defaults:
 env:
   PIP_DISABLE_PIP_VERSION_CHECK: 1
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: "Python ${{ matrix.python-version }} on ${{ matrix.os }}"

.github/workflows/python-nightly.yml

@@ -22,6 +22,9 @@ env:
   PIP_DISABLE_PIP_VERSION_CHECK: 1
   COVERAGE_IGOR_VERBOSE: 1
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: "Python ${{ matrix.python-version }}"