[CI] Minimal GitHub Actions permissions (#7165)

* add permission block

* add permissions block

* add permission block

* add permissions block

* switch order

.github/workflows/codeql.yml

@@ -9,8 +9,8 @@
 name: CodeQL
 
 permissions:
-  security-events: write    # needed to post results
   contents: read
+  security-events: write    # needed to post results
 
 on:
   push:

.github/workflows/desktop-lint.yml

@@ -1,5 +1,8 @@
 name: Code Style (C++) 
 
+permissions:
+  contents: read
+
 on:
   # Push trigger not needed for linting, we do not allow direct pushes to master
   pull_request:

.github/workflows/documentation-build.yml

@@ -1,5 +1,8 @@
 name: Generate Docs
 
+permissions:
+  contents: read    # write permission to the destination repo come from 'deploy_key'
+
 on:
   pull_request:
     paths:

.github/workflows/translations-pull.yml

@@ -1,5 +1,9 @@
 name: Update Translations
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     paths:

.github/workflows/translations-push.yml

@@ -1,5 +1,9 @@
 name: Update Translation Source
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     paths: