GHA: clarify workflows permissions, set least possible privilege

Set top-level permissions to None on all workflows, setting per-job
permissions. This avoids that new jobs inherit unwanted permissions.

Discussion: https://curl.se/mail/lib-2022-11/0028.html

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

Closes #9928

.github/workflows/appveyor-status.yml

@@ -11,13 +11,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.sha }}-${{ github.event.target_url }}
   cancel-in-progress: true
 
-permissions:
+permissions: {}
-  statuses: write
 
 jobs:
   split:
     runs-on: ubuntu-latest
     if: ${{ github.event.sender.login == 'appveyor[bot]' }}
+    permissions:
+      statuses: write
     steps:
       - name: Create individual AppVeyor build statuses
         if: ${{ github.event.sha && github.event.target_url }}

.github/workflows/codeql-analysis.yml

@@ -18,12 +18,13 @@ on:
 concurrency:
   group: ${{ github.workflow }}
 
-permissions:
+permissions: {}
-  security-events: write
 
 jobs:
   codeql:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
     steps:
     - name: Checkout repository
       uses: actions/checkout@v3

.github/workflows/fuzz.yml

@@ -17,6 +17,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   fuzzing:
     runs-on: ubuntu-latest

.github/workflows/hacktoberfest-accepted.yml

@@ -14,16 +14,17 @@ concurrency:
   # this should not run in parallel, so just run one at a time
   group: ${{ github.workflow }}
 
-permissions:
+permissions: {}
-  # requires issues AND pull-requests write permissions to edit labels on PRs!
-  issues: write
-  pull-requests: write
 
 jobs:
   # add hacktoberfest-accepted label to PRs opened starting from September 30th
   # till November 1st which are closed via commit reference from master branch.
   merged:
     runs-on: ubuntu-latest
+    permissions:
+      # requires issues AND pull-requests write permissions to edit labels on PRs!
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v3
         with:

.github/workflows/linkcheck.yml

@@ -23,6 +23,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   # Docs: https://github.com/marketplace/actions/markdown-link-check
   check:

.github/workflows/linux.yml

@@ -17,6 +17,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   autotools:
     name: ${{ matrix.build.name }}

.github/workflows/macos.yml

@@ -17,6 +17,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   autotools:
     name: ${{ matrix.build.name }}

.github/workflows/ngtcp2-gnutls.yml

@@ -18,6 +18,8 @@ concurrency:
   group: ngtcp2-gnutls-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   autotools:
     name: ${{ matrix.build.name }}

.github/workflows/ngtcp2-wolfssl.yml

@@ -18,6 +18,8 @@ concurrency:
   group: ngtcp2-wolfssl-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   autotools:
     name: ${{ matrix.build.name }}

.github/workflows/proselint.yml

@@ -23,6 +23,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/reuse.yml

@@ -18,6 +18,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/spellcheck.yml

@@ -21,10 +21,11 @@ on:
     - '**.1'
     - '.github/**'
 
+permissions: {}
+
 jobs:
   check:
     runs-on: ubuntu-latest
-
     steps:
     - uses: actions/checkout@v2
 

.github/workflows/torture.yml

@@ -18,6 +18,8 @@ concurrency:
   group: torture-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   autotools:
     name: ${{ matrix.build.name }}

.github/workflows/wolfssl.yml

@@ -18,6 +18,8 @@ concurrency:
   group: wolfssl-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   autotools:
     name: ${{ matrix.build.name }}