ci: set contents read as default workflow permissions

.github/workflows/upx-releases-json.yml

@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   schedule:
@@ -27,6 +31,10 @@ jobs:
   open-pr:
     runs-on: ubuntu-22.04
     if: github.event_name != 'pull_request'
+    permissions:
+      # required to create PR
+      contents: write
+      pull-requests: write
     needs:
       - generate
     steps: