Add least-privilege permissions to CI workflow

Author: honnibal

.github/workflows/cibuildwheel.yml

@@ -13,7 +13,7 @@ permissions: {}
 
 jobs:
   build_wheels:
-    uses: explosion/gha-cibuildwheel/.github/workflows/cibuildwheel.yml@2c98f757f13d112cf73fcf4b627249f1fffb5aae # main
+    uses: explosion/gha-cibuildwheel/.github/workflows/cibuildwheel.yml@d0d89c035a9cd4b9b847b179c88508d7cbee965f # main
     permissions:
       contents: write
       actions: read

.github/workflows/tests.yml

@@ -7,7 +7,8 @@ on:
     branches: ["*"]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 concurrency:
   group: tests-${{ github.ref }}