GitHub Workflows security hardening (#5365)

* build: harden pypi_upload.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>

* build: harden ci.yaml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>

Author: sashashura

.github/workflows/ci.yaml

@@ -32,6 +32,8 @@ on:
       - ".gitmodules"
       - ".gitattributes"
       - ".editorconfig"
+permissions:
+  contents: read # to fetch code (actions/checkout)
 jobs:
   lint:
     name: Check code linting

.github/workflows/pypi_upload.yml

@@ -6,8 +6,12 @@ on:
     tags:
       - v[0-9]+.[0-9]+.*  # add .* to allow dev releases
 
+permissions: {}
 jobs:
   deploy:
+    permissions:
+      contents: write # to create a release (actions/create-release)
+
     name: pipenv PyPI Upload
     runs-on: ubuntu-latest
     env: