ci: restrict permissions to the empty set by default (Stebalien#389)

This is already the default in the repo settings, but we might as well
re-iterate this here.

Author: Stebalien

.github/workflows/ci.yml

@@ -15,6 +15,8 @@ env:
   ANDROID_VERSION: "12.0.0"
   WASMTIME_BACKTRACE_DETAILS: 1
 
+permissions: {}
+
 name: CI
 jobs:
   deny:

.github/workflows/freebsd.yml

@@ -8,6 +8,7 @@ on:
     branches:
       - master
 
+permissions: {}
 jobs:
   freebsd:
     runs-on: ubuntu-latest