ci: add read-only workflow token permissions

[Alb3e3]

Summary

All four GitHub Actions workflows lacked an explicit workflow-level permissions: block. Without one, each run inherits the repository default GITHUB_TOKEN permissions, which can be broader than these jobs need.

This revision keeps the patch focused on workflow token permissions and sets the default token scope to read-only repository contents access.

Changes

• build.yaml: add permissions: contents: read
• coverity-scan.yml: add permissions: contents: read
• doxygen.yml: add permissions: contents: read; the deploy job keeps its existing job-level pages: write and id-token: write permissions
• test-ssllib.yml: add permissions: contents: read

Verification

python3 - <<'PY'
import pathlib, yaml
for p in pathlib.Path('.github/workflows').glob('*.yml'):
    yaml.safe_load(p.read_text())
for p in pathlib.Path('.github/workflows').glob('*.yaml'):
    yaml.safe_load(p.read_text())
print('yaml ok')
PY

Result: yaml ok.

[flichtenheld]

If we change this I would prefer we document the actually needed permissions.

[flichtenheld]

I don't exactly understand what this protects against? Injection by whom? This is all hard-coded stuff.

[flichtenheld]

Does not actually work. See GHA run.

env: only ${VARNAME} expansion is supported, error at: $LIBPREFIX/include" OPENSSL_LIBS="-L$LIBPREFIX/lib -lssl -lcrypto" LDFLAGS="-Wl,-rpath=$LIBPREFIX/lib"