fix: add explicit permissions to all GitHub Actions workflows

Add top-level permissions blocks to restrict GITHUB_TOKEN scope,
resolving 24 CodeQL code-scanning alerts (actions/missing-workflow-permissions).

Without explicit permissions, workflows get the repo's default token
permissions, which is typically overly broad. This follows the principle
of least privilege — if a compromised action runs, it only has the
minimum access needed.

- action-ci.yml: contents: read
- pr.yml: contents: read
- pre-commit.yml: contents: read
- release.yml: contents: read (jobs needing write already have explicit blocks)
- security_audit.yml: contents: read, security-events: write
- typescript_library.yml: contents: read

Author: Zee2413

.github/workflows/action-ci.yml

@@ -8,6 +8,8 @@ on:
     paths:
       - "action/**"
       - "action.yml"
+permissions:
+  contents: read
 jobs:
   run-unit-tests:
     runs-on: ubuntu-latest

.github/workflows/pr.yml

@@ -13,7 +13,8 @@ on:
 env:
   CARGO_TERM_COLOR: always
   FUZZ_TIME: 420
-
+permissions:
+  contents: read
 jobs:
   build:
     name: Build all crates & run unit tests

.github/workflows/pre-commit.yml

@@ -14,6 +14,8 @@ on:
       - .github/workflows/pre-commit.yml
       - .pre-commit-config.yaml
       - .pre-commit-hooks.yaml
+permissions:
+  contents: read
 jobs:
   run-unit-tests-and-lint:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -19,7 +19,8 @@ on:
         default: false
 env:
   CARGO_TERM_COLOR: always
-
+permissions:
+  contents: read
 jobs:
   # ---------------------------------------------------------------------------
   # 1. Validate input & run tests

.github/workflows/security_audit.yml

@@ -2,7 +2,8 @@ name: Security audit
 on:
   schedule:
     - cron: "0 17 * * *"
-
+permissions:
+  contents: read
 jobs:
   audit:
     if: github.repository == 'aws-cloudformation/cloudformation-guard'

.github/workflows/typescript_library.yml

@@ -6,6 +6,8 @@ on:
   pull_request:
     paths:
       - 'guard/ts-lib/**'
+permissions:
+  contents: read
 jobs:
   run-unit-tests-windows:
     runs-on: windows-latest