Update checkout module, add read permission to GH action

Author: Blake-Madden

.github/workflows/codeql.yml

@@ -10,7 +10,7 @@
 # supported CodeQL languages.
 #
 name: "CodeQL"
-on: [push]
+on: [push,pull_request]
 
 jobs:
   analyze:
@@ -32,7 +32,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: install tools
       run: |

.github/workflows/cppcheck.yml

@@ -5,14 +5,15 @@ jobs:
   build:
     name: cppcheck-test
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - name: cppcheck
         uses: deep5050/cppcheck-action@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN}}
-          std: c++17
+          std: c++20
           inline_suppression: enable
           exclude_check: ./tests
           output_file: cppcheck_report.txt

.github/workflows/doxygen.yml

@@ -1,12 +1,14 @@
 name: doxygen
-on: [push]
+on: [push,pull_request]
 
 jobs:
   build:
     name: doxygen-test
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: 'true'
 

.github/workflows/i18n-check.yml

@@ -1,12 +1,14 @@
 name: quneiform
-on: [push]
+on: [push,pull_request]
 
 jobs:
   build:
     name: quneiform
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: install quneiform
         run: |

.github/workflows/macos-unit-tests.yml

@@ -1,5 +1,5 @@
 name: macOS Build & Unit Tests
-on: [push]
+on: [push,pull_request]
 
 jobs:
   build:

.github/workflows/msvc.yml

@@ -7,7 +7,7 @@
 # https://github.com/microsoft/msvc-code-analysis-action
 
 name: Microsoft C++ Code Analysis
-on: [push]
+on: [push,pull_request]
 
 env:
   # Path to the CMake build directory.
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: 'true'
 

.github/workflows/spell-check.yml

@@ -1,14 +1,16 @@
 name: Spell Check
-on: [push]
+on: [push,pull_request]
 
 jobs:
   check-unix:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     name: Check Spelling
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install codespell
         run: |