ci: declare explicit least-privilege permissions (fix Token-Permissions)

.github/workflows/codeql.yml

@@ -10,7 +10,6 @@ on:
   workflow_dispatch:
 
 permissions:
-  security-events: write
   contents: read
 
 jobs:

.github/workflows/dependency-review.yml

@@ -4,6 +4,7 @@ on: [pull_request]
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   dependency-review:

.github/workflows/scorecard.yml

@@ -6,7 +6,8 @@ on:
   push:
     branches: [master]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis: