Resolve a rash of missing-permissions issues called out by CodeQL

Shouldn't need package permissions for a public image

Try with top-level permissions block

Author: greenc-FNAL

.github/workflows/add-issues.yaml

@@ -5,6 +5,8 @@ on:
     types:
       - opened
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add issue to project

.github/workflows/clang-format-check.yaml

@@ -1,6 +1,10 @@
 name: Clang-Format Check
 run-name: "${{ github.actor }} checking code format"
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request:
     branches: [ main ]

.github/workflows/clang-format-fix.yaml

@@ -7,8 +7,8 @@ on:
       - created
 
 permissions:
-   pull-requests: write
-   contents: write
+  pull-requests: write
+  contents: write
 
 jobs:
   check:

.github/workflows/clang-tidy-check.yaml

@@ -1,6 +1,10 @@
 name: Clang-Tidy Check
 'run-name': "${{ github.actor }} running clang-tidy check"
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request:
     branches: [ main ]

.github/workflows/clang-tidy-fix.yaml

@@ -7,8 +7,8 @@ on:
       - created
 
 permissions:
-   pull-requests: write
-   contents: write
+  pull-requests: write
+  contents: write
 
 jobs:
   check:

.github/workflows/cmake-build.yaml

@@ -6,6 +6,10 @@ on:
     types: [created]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: read
+
 env:
   BUILD_TYPE: Release
 

.github/workflows/cmake-format-check.yaml

@@ -1,6 +1,10 @@
 name: CMake Format Check
 run-name: "${{ github.actor }} running CMake format check"
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request:
     branches: [ main ]

.github/workflows/cmake-format-fix.yaml

@@ -7,8 +7,8 @@ on:
       - created
 
 permissions:
-   pull-requests: write
-   contents: write
+  pull-requests: write
+  contents: write
 
 jobs:
   check:

.github/workflows/coverage.yaml

@@ -18,6 +18,10 @@ on:
         required: false
         default: 'ON'
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   detect-coverage-changes:
     runs-on: ubuntu-latest