gha: tweak settings, add testing for "stable" and "oldstable" go

- set default permissions to "content: read" as actions in this repository
  don't require write acccess.
- set a guardrails timeout; this should not be needed normally, but
  GitHub's default timeout is 6 Hours, and prevents runaway actions
  that may happen occasionally on GitHub service outages.
- remove filter for branch name and run on pull-requests, push events
- add "stable" and "oldstable" Go versions to the matrix; these always
  point to the currently maintained versions of Go (currently Go1.25
  and Go1.24).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Author: thaJeztah

.github/workflows/ci.yaml

@@ -1,19 +1,24 @@
 name: CI
 
-on:
-  push:
-    branches: [master]
-  pull_request:
+on: [push, pull_request]
+
+# Default to 'contents: read', which grants actions to read commits. Any
+# permission not included is implicitly set to "none".
+#
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
 
 jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    timeout-minutes: 20 # guardrails timeout
 
     strategy:
       fail-fast: false
       matrix:
-        go: ["1.12", "1.21", "1.22", "1.23"]
+        go: ["1.12", "1.21", "1.22", "1.23", "oldstable", "stable"]
 
     steps:
       - name: Checkout repository
@@ -32,6 +37,7 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 20 # guardrails timeout
 
     steps:
       - name: Checkout repository
@@ -40,7 +46,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
-          go-version: "1.23"
+          go-version: "stable"
 
       - name: Lint
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0