build: add explicit workflow permissions and disable credential persistence

zizmor flagged two more findings once these files started being
scanned: excessive-permissions (Medium, blocking) because none of
the three workflows declared an explicit permissions: block and so
ran with the default broad GITHUB_TOKEN scope, and artipacked (Low,
informational) because checkout steps left credentials persisted in
the git config, which get exposed to anything that later reads the
workspace (e.g. artifact uploads).

- build.yml: contents: read (checkout + build only, no writes)
- lint.yml: contents: read, security-events: write (needed for
  github/codeql-action/upload-sarif)
- generate-v3.yml: contents: read (the actual PR push uses its own
  SYNCED_GITHUB_TOKEN_REPO secret via peter-evans/create-pull-request,
  not the default token)
- persist-credentials: false added to every actions/checkout step
  across all three files; none of them do a subsequent git push with
  the default token, so this is safe.

Author: kikoso

.github/workflows/build.yml

@@ -25,6 +25,9 @@ on:
     types: [ build ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   build-ApiDemos:
@@ -33,6 +36,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
       uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -56,6 +61,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
       uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -75,6 +82,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
       uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -94,6 +103,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
       uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -119,6 +130,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
       uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -144,6 +157,8 @@ jobs:
       - build-tutorials
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: set up Java 21
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:

.github/workflows/generate-v3.yml

@@ -19,13 +19,18 @@ on:
   repository_dispatch:
     types: [ generate-v3 ]
 
+permissions:
+  contents: read
+
 jobs:
   generate-v3:
     runs-on: ubuntu-latest
     timeout-minutes: 45
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up JDK 17
       uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0

.github/workflows/lint.yml

@@ -19,13 +19,19 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   lint:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0