ci: Reduce permissions and add zizmor setting

Author: tarsius

.github/workflows/compile.yml

@@ -3,4 +3,6 @@ on: [push, pull_request]
 jobs:
   compile:
     name: Compile
-    uses: emacscollective/workflows/.github/workflows/compile.yml@main
+    uses: | # zizmor: ignore[unpinned-uses] same maintainer as this repo
+      emacscollective/workflows/.github/workflows/compile.yml@main
+    permissions: {}

.github/workflows/manual.yml

@@ -6,6 +6,8 @@ on:
 jobs:
   manual:
     name: Manual
-    uses: emacscollective/workflows/.github/workflows/manual.yml@main
+    uses: | # zizmor: ignore[unpinned-uses] same maintainer as this repo
+      emacscollective/workflows/.github/workflows/manual.yml@main
+    permissions: {}
     secrets:
       rclone_config: ${{ secrets.RCLONE_CONFIG }}

.github/workflows/stats.yml

@@ -7,6 +7,8 @@ on:
 jobs:
   stats:
     name: Statistics
-    uses: emacscollective/workflows/.github/workflows/stats.yml@main
+    uses: | # zizmor: ignore[unpinned-uses] same maintainer as this repo
+      emacscollective/workflows/.github/workflows/stats.yml@main
+    permissions: {}
     secrets:
       rclone_config: ${{ secrets.RCLONE_CONFIG }}

.github/workflows/test.yml

@@ -3,4 +3,6 @@ on: [push, pull_request]
 jobs:
   test:
     name: Test
-    uses: emacscollective/workflows/.github/workflows/test.yml@main
+    uses: | # zizmor: ignore[unpinned-uses] same maintainer as this repo
+      emacscollective/workflows/.github/workflows/test.yml@main
+    permissions: {}