Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR adds minimum token permissions to all GitHub workflow files to improve security posture according to OpenSSF Scorecard recommendations.

Changes Made

Root-Level Permissions Added

Added permissions: contents: read to 14 workflow files that were missing root-level permissions:

• close-stale.yml
• codeql-analysis.yml
• component-owners.yml
• label-prs.yml
• lint.yml
• peer-api.yaml
• pr-title.yml
• release-please-validate.yaml
• release-please.yml
• test-all-versions.pr.yml
• test-all-versions.push.yml
• test-all-versions.yml
• unit-test.yml
• update-otel-deps.yaml

Job-Level Permissions Added

Added appropriate job-level write permissions where needed:

• close-stale.yml: Added issues: write and pull-requests: write for stale bot actions
• codeql-analysis.yml: Added security-events: write for CodeQL analysis uploads
• component-owners.yml: Added pull-requests: write for assigning reviewers
• pr-title.yml: Added pull-requests: write for PR title validation comments
• release-please.yml: Added contents: write and pull-requests: write for release actions

Existing Permissions Preserved

The following files already had proper root-level permissions and were left unchanged:

• fossa.yml (already had permissions: contents: read)
• ossf-scorecard.yml (already had permissions: read-all)

Verification

All 16 workflow files now pass OpenSSF Scorecard Token-Permissions check:

• ✅ Every workflow has root-level permissions defined
• ✅ Root-level permissions are limited to contents: read or read-all
• ✅ Write permissions are properly scoped to job level where needed
• ✅ All permissions include explanatory comments for write access requirements

Security Impact

This change significantly improves the repository's security posture by:

• Implementing the principle of least privilege for workflow permissions
• Reducing the attack surface by limiting default token permissions
• Meeting OpenSSF Scorecard security requirements for token permissions

Fixes #16.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.