Add required permissions to workflows

- Add permissions block to all workflows
- Set minimal required permissions (contents: read)
- Add pull-requests: write for PR validation
- Fix CodeQL security warnings

Author: oscarvalenzuelab

.github/workflows/pr-validation.yml

@@ -1,5 +1,9 @@
 name: PR Validation
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     types: [opened, synchronize, reopened]

.github/workflows/release.yml

@@ -1,15 +1,15 @@
 name: Release
 
+permissions:
+  contents: write
+  id-token: write
+
 on:
   push:
     tags:
       - 'v*'
   workflow_dispatch:
 
-permissions:
-  contents: write
-  id-token: write
-
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest

.github/workflows/test.yml

@@ -1,5 +1,8 @@
 name: Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main, develop ]