ci: declare workflow-level contents: read on 4 workflows

.github/workflows/branch_snapshot.yml

@@ -15,6 +15,9 @@ on:
         description: 'The version number to use'
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/gradle-wrapper-validation.yml

@@ -1,6 +1,9 @@
 name: "Validate Gradle Wrapper"
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   validation:
     name: "Gradle wrapper validation"

.github/workflows/pr.yml

@@ -2,6 +2,9 @@ name: PR Build
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/snapshot.yml

@@ -6,6 +6,9 @@ on:
       - master
       - zuul-v4
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest