ci: declare explicit read-only workflow permissions

.github/workflows/pre-commit.yaml

@@ -3,6 +3,10 @@ on:
   pull_request:
   push:
     branches: [main, stable]
+
+permissions:
+  contents: read
+
 jobs:
   main:
     runs-on: ubuntu-latest

.github/workflows/tests.yaml

@@ -5,6 +5,10 @@ on:
   push:
     branches: [main, stable]
     paths-ignore: ['docs/**', 'README.md']
+
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: ${{ matrix.name || matrix.python }}