SEC: force workflows to be read-only.

Via tidelift and suggested by
https://deps.dev/pypi/ipython

.github/workflows/docs.yml

@@ -2,6 +2,9 b' name: Build docs'
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/downstream.yml

@@ -8,6 +8,8 b' on:'
   - cron:  '23 1 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
 
 jobs:
   test:

.github/workflows/mypy.yml

@@ -6,6 +6,9 b' on:'
   pull_request:
     branches: [ main, 7.x]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 

.github/workflows/python-package.yml

@@ -3,6 +3,9 b''
 
 name: Python package
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main, 7.x ]