Add permissions blocks to all workflows

.github/workflows/check-submodule-pointers.yml

@@ -14,6 +14,9 @@ on:
   schedule:
     - cron: '42 12 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   check-submodules:
     runs-on: ubuntu-latest

.github/workflows/mirror-main-to-master.yml

@@ -6,6 +6,9 @@ on:
   push:
     branches: [ main ]
 
+permissions:
+  contents: write
+
 jobs:
   mirror-main-to-master:
     runs-on: ubuntu-latest

.github/workflows/report-failure.yml

@@ -24,4 +24,3 @@ jobs:
             --repo "$GITHUB_REPOSITORY" \
             --title "Submodule pointers out of date: $TODAY" \
             --body "Submodule pointer check failed: $WORKFLOW_RUN_URL"
-