fix(ci): top level permissions, env hardening

.github/workflows/compress-images.yml

@@ -3,11 +3,19 @@
 # Open a Pull Request if any images can be compressed.
 name: Compress Images on Demand
 
+env:
+  ACTIONS_ALLOW_UNSECURE_COMMAND=false
+
 on:
   workflow_dispatch:
   schedule:
     - cron: "00 23 * * 0"
 
+permissions:
+  contents: write
+  statuses: write
+  pull-requests: write
+
 jobs:
   CompressOnDemandOrSchedule:
     name: calibreapp/image-actions