Per-job permissions for create_new_cache and rust workflows

[arpitjain099]

Two remaining workflows in this repo run without an explicit permissions: block, so the GITHUB_TOKEN falls back to the repo/org default scope (typically broader than necessary). The hardened siblings (codeql.yml, copilot-setup-steps.yml) already use per-job permissions blocks, so this PR matches that style.

create_new_cache.yml

Two jobs (ubuntu, windows). Both checkout the repo and call actions/cache/save@v5 to populate the Cargo cache. Granted:

permissions:
  contents: read
  actions: write   # required by actions/cache/save

rust.yml

Three jobs (build_ubuntu, provider_integration, build_windows). They run cargo lint/test, upload artifacts, and use actions/cache@v5 (which saves on cache miss) plus actions/cache/restore@v5 (read-only). Same minimal scope as above is sufficient because the workflow only reads source and writes to the cache.

YAML validated locally with python3 -c "import yaml; yaml.safe_load(...)" for both files. No behavioral change.

[Copilot]

Pull request overview

This PR hardens GitHub Actions security by adding explicit per-job permissions: blocks to the remaining workflows that were relying on the repository/org default GITHUB_TOKEN scope, aligning them with the existing style used in codeql.yml and copilot-setup-steps.yml.

Changes:

• Add per-job permissions to .github/workflows/rust.yml for all three jobs (build_ubuntu, provider_integration, build_windows).
• Add per-job permissions to .github/workflows/create_new_cache.yml for both cache-priming jobs (Ubuntu/Windows).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/rust.yml	Adds per-job token scoping (contents: read, actions: write) for builds/tests/caching/artifact upload jobs.
.github/workflows/create_new_cache.yml	Adds per-job token scoping (contents: read, actions: write) for cache creation jobs using actions/cache/save.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[arpitjain099]

Hi @rajesh-gali, gentle ping on this. PR has been open for 4 days without review. I noticed you've been on the recent-merger side of recent merges in this repo. When you have a moment, would you mind giving it a quick look? No urgency. Happy to address any feedback.