[gha] Update explicit permissions

Author: hazendaz

.github/workflows/ci.yaml

@@ -2,6 +2,8 @@ name: Java CI
 
 on: [workflow_dispatch, push, pull_request]
 
+permissions: read-all
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}

.github/workflows/codeql.yaml

@@ -31,8 +31,8 @@ jobs:
         uses: actions/setup-java@v4
         with:
           cache: maven
-          java-version: 21
           distribution: 'temurin'
+          java-version: 21
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/coveralls.yaml

@@ -2,6 +2,8 @@ name: Coveralls
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   coveralls:
     if: github.repository_owner == 'mybatis'

.github/workflows/sonar.yaml

@@ -5,6 +5,8 @@ on:
     branches:
       - master
 
+permissions: read-all
+
 jobs:
   build:
     if: github.repository_owner == 'mybatis'

.github/workflows/sonatype.yaml

@@ -5,6 +5,8 @@ on:
     branches:
       - master
 
+permissions: read-all
+
 jobs:
   build:
     if: github.repository_owner == 'mybatis' && ! contains(toJSON(github.event.head_commit.message), '[maven-release-plugin]')