Restrict GITHUB_TOKEN permissions on GitHub Actions

[nikunj-kohli]

Summary

This PR restricts GITHUB_TOKEN permissions across all GitHub Actions workflows to follow the principle of least privilege, as recommended by GitHub and OpenSSF.

Problem: Currently, workflows use the default GITHUB_TOKEN permissions which are excessively permissive (read/write access to all issues, PRs, and repository contents). This token is available to all code and actions in a workflow, meaning malicious code in dependencies could steal the token and perform unauthorized actions.

Solution:

• Added permissions: read-all as a top-level declaration to all 20 workflows that were missing it
• Workflows that require write access retain job-level permission overrides
• All 25 workflows now have explicit permissions defined

Security Improvements:

1. Least Privilege: All workflows default to read-only access
2. Reduced Attack Surface: Malicious code cannot steal tokens with excessive permissions
3. Explicit Write Access: Only jobs that specifically need write permissions have them
4. Best Practices Compliance: Follows GitHub and OpenSSF recommendations

Modified Workflows (20 files):

• add-release-pongo.yml, ast-grep.yml, autodocs.yml, backport-fail-bot.yml, build.yml, build_and_test.yml, buildifier.yml, changelog-requirement.yml, changelog-validation.yml, community-stale.yml, copyright-check.yml, label-check.yml, label-schema.yml, labeler-v2.yml, openresty-patches-companion.yml, perf.yml, release.yml, update-ngx-wasm-module.yml, update-test-runtime-statistics.yml, upgrade-tests.yml

Checklist

• The Pull Request has tests (N/A - security hardening only, no functional changes)
• A changelog file has been created under changelog/unreleased/kong or skip-changelog label added on PR if changelog is unnecessary. README.md
• There is a user-facing docs PR against https://github.com/Kong/developer.konghq.com - PUT DOCS PR HERE (N/A - internal workflow security improvement)

Issue reference

Fix #14778

[CLAassistant]

All committers have signed the CLA.