ci: give every workflow an explicit least-privilege GITHUB_TOKEN (#101)

CodeQL actions/missing-workflow-permissions: chain-endpoints.yml, lock.yml, pr-any.yml, test-nightly.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.

.github/workflows/chain-endpoints.yml

@@ -6,6 +6,12 @@ on:
     # once daily (early mornings, 02:50 GMT, generally not busy)
     - cron:  '50 2 * * *'
 
+
+# GITHUB_TOKEN only opens an issue when the endpoint check fails.
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   endpoints:
     if: github.repository == 'pezkuwichain/pezkuwi-apps'