ci: Restrict master workflow permissions (#58)

Declare contents: read for the two legacy master workflows flagged by CodeQL. This is a focused default-branch fix; reviewability-v1 already deletes pylint.yml and has PR #50 for its active test workflow.

Validation: git diff --check.

Author: BenWestgate

.github/workflows/pylint.yml

@@ -2,6 +2,9 @@ name: Pylint
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/python-package.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
     branches: [ "master" ]
 
+permissions:
+  contents: read
+
 jobs:
   build: