ci: drop unnecessary workflow permissions

Add top-level empty permissions block in all CI workflows, and provide
explanatory comments for all write permissions. The only actual
permissions change is to `unit-tests`, which was previously given overly
broad default permissions but only needs to be able to read repo
contents.

See https://docs.zizmor.sh/audits/#excessive-permissions for more info
on how the default permissions are overly broad.

.github/workflows/ci.yml

@@ -7,10 +7,14 @@ on:
   pull_request:
     branches: [main]
 
+permissions: {}
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
     container: quay.io/fedora/fedora:latest
+    permissions:
+      contents: read
     steps:
       - name: Install tools
         run: dnf install -y cargo clippy rustfmt just ShellCheck nodejs-npm openssl-devel git jq
@@ -54,7 +58,7 @@ jobs:
     name: ${{ matrix.name }}
     permissions:
       contents: read
-      packages: write
+      packages: write # Required to push image to ghcr.io
     container:
       image: quay.io/fedora/fedora:latest
       options: --privileged --cgroupns=host -v /var/lib/containers -v /var/tmp -v /tmp
@@ -85,8 +89,8 @@ jobs:
     if: github.event_name == 'push'
     runs-on: ubuntu-24.04
     permissions:
-      packages: write
-      id-token: write
+      packages: write # Required to push image to ghcr.io
+      id-token: write # Required to get ID token to sign image using Cosign
     steps:
       - name: Install cosign
         uses: sigstore/cosign-installer@v4.1.1
@@ -120,8 +124,8 @@ jobs:
     if: github.event_name == 'push'
     runs-on: ubuntu-24.04
     permissions:
-      packages: write
-      id-token: write
+      packages: write # Required to clean up old images from ghcr.io
+      id-token: write # Required to get ID token to sign image using Cosign
     steps:
       - name: Install skopeo
         run: sudo apt-get update && sudo apt-get install -y skopeo

.github/workflows/dependabot.yml

@@ -2,13 +2,14 @@ name: Dependabot
 
 on: pull_request
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   automerge:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required to merge PR
+      pull-requests: write # Required to enable auto-merge for PR
     if: github.actor == 'dependabot[bot]'
     steps:
       - name: Fetch Dependabot metadata

.github/workflows/msrv-bump.yml

@@ -6,14 +6,15 @@ on:
     - cron: '0 9 * * 1'
   workflow_dispatch: {}
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   check-msrv:
     runs-on: ubuntu-latest
     container: registry.access.redhat.com/ubi9/ubi:latest
+    permissions:
+      contents: write # Required to create branch for PR
+      pull-requests: write # Required to create PR
     steps:
       - name: Install tools
         run: dnf install -y git