[actions] restrict permissions

.github/workflows/node-aught.yml

@@ -2,6 +2,9 @@ name: 'Tests: node.js < 10'
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     uses: ljharb/actions/.github/workflows/node.yml@main

.github/workflows/node-pretest.yml

@@ -2,6 +2,11 @@ name: 'Tests: pretest/posttest'
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     uses: ljharb/actions/.github/workflows/pretest.yml@main
+    with:
+      skip-pack: true # `npm run tests-only` fails in node 15+ without NODE_OPTIONS=--unhandled-rejections=none, but older nodes throw for unrecognized NODE_OPTIONS

.github/workflows/node-tens.yml

@@ -2,6 +2,9 @@ name: 'Tests: node.js >= 10'
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     uses: ljharb/actions/.github/workflows/node.yml@main

.github/workflows/rebase.yml

@@ -2,8 +2,14 @@ name: Automatic Rebase
 
 on: [pull_request_target]
 
+permissions:
+  contents: read
+
 jobs:
   _:
+    permissions:
+      contents: write
+      pull-requests: read
     name: "Automatic Rebase"
 
     runs-on: ubuntu-latest

.github/workflows/require-allow-edits.yml

@@ -2,8 +2,13 @@ name: Require “Allow Edits”
 
 on: [pull_request_target]
 
+permissions:
+  contents: read
+
 jobs:
   _:
+    permissions:
+      pull-requests: read
     name: "Require “Allow Edits”"
 
     runs-on: ubuntu-latest