ci: set default permissions for workflows

The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions

.github/workflows/codeql.yml

@@ -12,6 +12,8 @@ on:
     branches: [ "master" ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze