ci: give every workflow an explicit least-privilege GITHUB_TOKEN (#101)

CodeQL actions/missing-workflow-permissions: chain-endpoints.yml, lock.yml, pr-any.yml, test-nightly.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.

.github/workflows/test-nightly.yml

@@ -5,6 +5,11 @@ on:
     - cron:  '1 5 * * *'
 
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   alltests:
     strategy: