chore: update github actions permissions

default to contents: read, then get specific in the jobs

Signed-off-by: jmeridth <jmeridth@gmail.com>

.github/FUNDING.md

@@ -1,2 +1 @@
 github: jmeridth
-custom: ['https://www.paypal.me/jmeridth']

.github/workflows/auto-author-assign.yml

@@ -2,9 +2,13 @@ name: 'Auto Author Assign'
 on:
   pull_request:
     types: [opened, reopened, synchronize]
+permissions:
+  contents: read
 jobs:
   assign:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: toshimaru/auto-author-assign@v2.1.0
         with:

.github/workflows/labeler.yml

@@ -1,6 +1,8 @@
 name: "Pull Request Labeler"
 on:
   pull_request_target:
+permissions:
+  contents: read
 jobs:
   labeler:
     permissions:

.github/workflows/stale.yml

@@ -3,14 +3,14 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '30 1 * * *' # https://crontab.guru/#30_1_*_*_* (everyday at 0130)
-
 permissions:
-  issues: write
-  pull-requests: write
-
+  contents: read
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@v9
         with: