GitHub Workflows security hardening

[sashashura]

This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.
It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.

[codecov]

Codecov Report

Merging #4630 (a032bbe) into master (8193ea5) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #4630   +/-   ##
=======================================
  Coverage   98.87%   98.87%           
=======================================
  Files         210      210           
  Lines        7373     7373           
  Branches     2106     2106           
=======================================
  Hits         7290     7290           
  Misses         27       27           
  Partials       56       56           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[rollup-bot]

This PR has been released as part of rollup@3.0.0-6. Note that this is a pre-release, so to test it, you need to install Rollup via npm install rollup@3.0.0-6 or npm install rollup@beta. It will likely become part of a regular release later.