CI: Consistently add a top-level permissions definition to GHA workflows

This makes it easy to verify the permissions and to apply them to all jobs
within a given workflow.

.github/workflows/aws-lc-fips.yml

@@ -5,6 +5,9 @@ on:
     - cron: "0 0 * * 4"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     uses: ./.github/workflows/aws-lc-template.yml

.github/workflows/aws-lc.yml

@@ -5,6 +5,9 @@ on:
     - cron: "0 0 * * 4"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     uses: ./.github/workflows/aws-lc-template.yml

.github/workflows/illumos.yml

@@ -5,12 +5,13 @@ on:
     - cron: "0 0 25 * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   gcc:
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'haproxy' || github.event_name == 'workflow_dispatch' }}
-    permissions:
-      contents: read
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@v5

.github/workflows/netbsd.yml

@@ -5,12 +5,13 @@ on:
     - cron: "0 0 25 * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   gcc:
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'haproxy' || github.event_name == 'workflow_dispatch' }}
-    permissions:
-      contents: read
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@v5

.github/workflows/quic-interop-aws-lc.yml

@@ -9,13 +9,13 @@ on:
   schedule:
     - cron: "0 0 * * 2"
 
+permissions:
+  contents: read
 
 jobs:
   combined-build-and-run:
     runs-on: ubuntu-24.04
     if: ${{ github.repository_owner == 'haproxy' || github.event_name == 'workflow_dispatch' }}
-    permissions:
-      contents: read
 
     steps:
       - uses: actions/checkout@v5

.github/workflows/quic-interop-libressl.yml

@@ -9,13 +9,13 @@ on:
   schedule:
     - cron: "0 0 * * 2"
 
+permissions:
+  contents: read
 
 jobs:
   combined-build-and-run:
     runs-on: ubuntu-24.04
     if: ${{ github.repository_owner == 'haproxy' || github.event_name == 'workflow_dispatch' }}
-    permissions:
-      contents: read
 
     steps:
       - uses: actions/checkout@v5