Add explicit permissions to GitHub Actions workflows

Following security best practices (supply chain hardening), add explicit
top-level permissions to all GitHub Actions workflows to enforce the
principle of least privilege. Moved job-level permissions to top-level
where applicable.

This addresses the GitHub Actions permissions requirements from the
Rancher Security Team supply chain risk scan.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

.github/workflows/build.yml

@@ -4,6 +4,9 @@
 
 name: Build
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types:

.github/workflows/changelogs.yml

@@ -3,6 +3,9 @@
 # SPDX-License-Identifier: Apache-2.0
 name: Changelogs
 
+permissions:
+  contents: read
+  pull-requests: write
 
 on:
   push:

.github/workflows/git-checks.yml

@@ -5,6 +5,9 @@
 
 name: Git Checks
 
+permissions:
+  contents: read
+
 on: [pull_request]
 
 jobs:

.github/workflows/mingo_build.yml

@@ -4,6 +4,9 @@
 
 name: Build with oldest go
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types:

.github/workflows/prebuilt_devcontainer.yml

@@ -3,6 +3,12 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: 'pre-built devcontainer'
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
 on:
   push:
     branches:
@@ -11,10 +17,6 @@ on:
 jobs:
   devcontainer-build-and-push:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-      packages: write
     steps:
       - name: Checkout
         id: checkout

.github/workflows/reuse.yml

@@ -4,6 +4,9 @@
 
 name: REUSE Compliance Check
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/vulncheck.yml

@@ -4,6 +4,9 @@
 
 name: Vulnerability check
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: