Hardening GITHUB_TOKEN permissions

[eskwor]

Hardening GITHUB_TOKEN permissions (least privilege)

• we started by setting permissions: {} to fully disable all default GITHUB_TOKEN access
• incrementally added only the permissions required for the workflow to succeed, based on observed errors

Why this change?

• reduces risk of accidental or malicious misuse of the token
• aligns with GitHub’s least-privilege security best practices
• makes permissions explicit, auditable, and easier to reason about

Result: a minimal, secure, and maintainable permission set tailored to the workflow’s real requirements

Tested OK using

• ci-spring-boot-build-publish-image.yml using https://github.com/felleslosninger/plattform-test-app/actions/runs/23452000457
• ci-quarkus-build-publish-image.yml using https://github.com/felleslosninger/plattform-test-app-quarkus/actions/runs/23482889666/job/68480742154
• ci-docker-build-publish-image.yml using https://github.com/felleslosninger/plattform-test-app/blob/main/.github/workflows/deploy-dockerfile.yml#L8C62-L8C88