chore(ci): gha-update, small cleanup (#45)

Author: woodruffw

.github/workflows/ci.yml

@@ -6,6 +6,8 @@ on:
       - main
   pull_request:
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -5,6 +5,8 @@ on:
 
 name: release
 
+permissions: {}
+
 jobs:
   release:
     runs-on: ubuntu-latest

.github/workflows/zizmor.yml

@@ -6,6 +6,8 @@ on:
   pull_request:
     branches: ["**"]
 
+permissions: {}
+
 jobs:
   zizmor:
     name: zizmor latest via Cargo