ci(workflows): assign explicit permissions (#392)

Author: caugner

.github/workflows/auto-merge.yml

@@ -3,10 +3,13 @@ name: auto-merge
 on:
   pull_request_target:
 
+# No GITHUB_TOKEN permissions, as we use AUTOMERGE_TOKEN instead.
+permissions: {}
+
 jobs:
   auto-merge:
     uses: mdn/workflows/.github/workflows/auto-merge.yml@main
     with:
-      target-repo: 'mdn/todo-vue'
+      target-repo: "mdn/todo-vue"
     secrets:
       GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}

.github/workflows/pr-test.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+# No GITHUB_TOKEN permissions, as we don't use it.
+permissions: {}
+
 jobs:
   build-lint:
     runs-on: ubuntu-latest