Constrain GH Actions workflows permissions (#2625)

.github/workflows/ci-docker.yml

@@ -17,6 +17,10 @@ on:
       - 'requirements*.txt'
       - 'platformio.ini'
 
+permissions:
+  contents: read
+  packages: read
+
 jobs:
   check-docker:
     name: Build docker containers

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
 
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: ${{ matrix.name }}

.github/workflows/release.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: "0 2 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   init:
     name: Initialize build
@@ -52,6 +55,9 @@ jobs:
   deploy-docker:
     name: Build and publish docker containers
     if: github.repository == 'esphome/esphome'
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs: [init]
     strategy:
@@ -93,6 +99,9 @@ jobs:
 
   deploy-docker-manifest:
     if: github.repository == 'esphome/esphome'
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs: [init, deploy-docker]
     strategy: