fix: harden workflow permissions - set top-level permissions: {} and scope perms to jobs

Set `permissions: {}` at the top level of all workflow files to deny all
permissions by default, then grant only the minimum required permissions at
the job level. This fixes the Docker push failure caused by missing
`packages: write` permission being scoped incorrectly.

Changes per workflow:
- build-testing-image.yml: add contents: read + packages: write to job
- action-security.yml: consolidate contents: read, actions: read,
  pull-requests: read into the analyze job
- codeql-new.yml: add actions: read to the analyze job
- dependency-review.yml: add contents: read to the dependency-review job
- issue-stats.yml: top-level only (no checkout, existing job perms sufficient)
- new-release.yml: was read-all; job already has contents: write
- pr-lint.yml: was contents: read + packages: read; job already has full perms
- release.yml: job already has contents: write
- security-suite.yml: move all perms to job level
- stale.yml: top-level only (no checkout, existing job perms sufficient)
- sync-labels.yml: was read-all; add contents: read to job for checkout
- version-maintenance.yml: move all perms to job level

Co-authored-by: ivuorinen <11024+ivuorinen@users.noreply.github.com>

.github/workflows/action-security.yml

@@ -17,10 +17,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
+permissions: {}
-  contents: read
-  actions: read
-  pull-requests: read
 
 jobs:
   analyze:
@@ -29,6 +26,9 @@ jobs:
     timeout-minutes: 30
 
     permissions:
+      contents: read
+      actions: read
+      pull-requests: read
       security-events: write
       statuses: write
       issues: write

.github/workflows/build-testing-image.yml

@@ -23,15 +23,16 @@ on:
         default: 'latest'
         type: string
 
-permissions:
+permissions: {}
-  contents: read
-  packages: write
 
 jobs:
   build-and-push:
     name: Build and Push Testing Image
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Checkout repository

.github/workflows/codeql-new.yml

@@ -13,17 +13,16 @@ on:
     - cron: '30 1 * * 0' # Run at 1:30 AM UTC every Sunday
   merge_group:
 
-permissions:
+permissions: {}
-  actions: read
-  contents: read
 
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     permissions:
-      security-events: write
+      actions: read
       contents: read
+      security-events: write
 
     strategy:
       fail-fast: false

.github/workflows/dependency-review.yml

@@ -4,12 +4,13 @@ name: 'Dependency Review'
 on:
   - pull_request
 
-permissions:
+permissions: {}
-  contents: read
 
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@71cf2267d89c5cb81562390fa70a37fa40b1305e # v6-beta

.github/workflows/issue-stats.yml

@@ -5,8 +5,7 @@ on:
   schedule:
     - cron: '3 2 1 * *'
 
-permissions:
+permissions: {}
-  contents: read
 
 jobs:
   build:

.github/workflows/new-release.yml

@@ -6,7 +6,7 @@ on:
   schedule:
     - cron: '0 21 * * *' # 00:00 at Europe/Helsinki
 
-permissions: read-all
+permissions: {}
 
 jobs:
   new-daily-release:

.github/workflows/pr-lint.yml

@@ -37,9 +37,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
+permissions: {}
-  contents: read
-  packages: read # Required for private dependencies
 
 jobs:
   megalinter:

.github/workflows/release.yml

@@ -7,8 +7,7 @@ on:
     tags:
       - 'v*'
 
-permissions:
+permissions: {}
-  contents: read
 
 jobs:
   release:

.github/workflows/security-suite.yml

@@ -18,11 +18,7 @@ on:
       - '**/*.yaml'
       - '.github/workflows/**'
 
-permissions:
+permissions: {}
-  contents: read
-  pull-requests: write
-  issues: write
-  actions: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
@@ -32,6 +28,11 @@ jobs:
   security-analysis:
     name: Security Analysis
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      actions: read
 
     steps:
       - name: Checkout PR

.github/workflows/stale.yml

@@ -8,10 +8,7 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
+permissions: {}
-  contents: read
-  packages: read
-  statuses: read
 
 jobs:
   stale:

.github/workflows/sync-labels.yml

@@ -22,7 +22,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: read-all
+permissions: {}
 
 jobs:
   labels:
@@ -31,6 +31,7 @@ jobs:
     timeout-minutes: 10
 
     permissions:
+      contents: read
       issues: write
 
     steps:

.github/workflows/version-maintenance.yml

@@ -12,15 +12,16 @@ on:
         required: false
         type: string
 
-permissions:
+permissions: {}
-  contents: write
-  pull-requests: write
-  issues: write
 
 jobs:
   check-and-update:
     name: Check Version References
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
 
     steps:
       - name: Checkout Repository