CodeQL - add permissions to GH workflows

.github/workflows/docker_linuxes.yml

@@ -1,5 +1,9 @@
 name: Docker-Linuxes
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/freebsd.yml

@@ -1,5 +1,9 @@
 name: FreeBSD
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/mac_debug.yml

@@ -1,5 +1,9 @@
 name: macOS-Debug
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/mac_release.yml

@@ -1,5 +1,9 @@
 name: macOS-Release
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/mac_release_shared.yml

@@ -1,5 +1,9 @@
 name: macOS-Release-shared
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/mac_release_static.yml

@@ -1,5 +1,9 @@
 name: macOS-Release-shared
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/ubuntu_address_sanitizer.yml

@@ -1,5 +1,9 @@
 name: Ubuntu-AddressSanitizer
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
@@ -58,9 +62,6 @@ jobs:
       # See https://cmake.org/cmake/help/latest/manual/ctest.1.html for more detail
       run: ctest -V --output-on-failure -C ${{env.BUILD_TYPE}} 
 
-
-
-
   openexr3:
     # The CMake configure and build commands are platform agnostic and should work equally well on Windows or Mac.
     # You can convert this to a matrix build if you need cross-platform coverage.

.github/workflows/ubuntu_debug.yml

@@ -1,5 +1,9 @@
 name: Ubuntu-Debug
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/ubuntu_no_libtiff.yml

@@ -1,5 +1,9 @@
 name: Ubuntu-No LibTIFF
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/ubuntu_release.yml

@@ -1,5 +1,9 @@
 name: Ubuntu-Release
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/windows_debug.yml

@@ -1,5 +1,9 @@
 name: Windows-Debug
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/windows_release.yml

@@ -1,5 +1,9 @@
 name: Windows-Release
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/windows_vcpkg_debug.yml

@@ -1,5 +1,9 @@
 name: Windows-vcpkg-Debug
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:

.github/workflows/windows_vcpkg_release.yml

@@ -1,5 +1,9 @@
 name: Windows-vcpkg-Release
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore: