github workflows: security hardening

This PR adds explicit permissions section to workflows. This is a security
best practice because by default workflows run with extended set of permissions
(except from on: pull_request from external forks). By specifying any permission
explicitly all others are set to none. By using the principle of least privilege
the damage a compromised workflow can do (because of an injection or compromised
third party tool or action) is restricted. It is recommended to have most strict
permissions on the top level and grant write permissions on job level case by case.

.github/workflows/openwrt-ci.yml

@@ -12,11 +12,17 @@ on:
     - cron: 0 20 * * *
   release:
     types: [published]
+    
+permissions:
+  contents: read
 
 jobs:
 
   build_openwrt:
 
+    permissions:
+      contents: write # for release creation
+
     name: Build OpenWrt firmware
 
     runs-on: ubuntu-latest