ci: set least-privilege workflow permissions (#555)

Add a top-level deny-all permissions block to qc.yml and codeql.yml, and
grant the QC job only contents: read. qc.yml previously set no permissions,
so it inherited the repository default token scope (code scanning alert #6,
CWE-275). codeql.yml already scoped its job permissions; this adds the
matching top-level default.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: turbomam

.github/workflows/codeql.yml

@@ -9,6 +9,9 @@ on:
     - cron: '0 6 * * 1'  # Monday 6am UTC
   workflow_dispatch:
 
+# Deny all permissions by default; the analyze job grants the minimum it needs.
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/qc.yml

@@ -13,13 +13,19 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Deny all permissions by default; grant the minimum needed at the job level.
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "ontology_qc"
   ontology_qc:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
     container: obolibrary/odkfull:v1.6.1
+    # Only needs to read the repository to check it out and run the QC make target.
+    permissions:
+      contents: read
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps: