workflows: Explicitly set minimal token permissions

This will allow us to set the default token permissions to restricted,
and thus avoid accidentally introducing over-privileged new workflows.

.github/workflows/cockpit-lib-update.yml

@@ -7,6 +7,9 @@ on:
 jobs:
   cockpit-lib-update:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
     steps:
       - name: Set up dependencies
         run: |

.github/workflows/npm-update-pf.yml

@@ -7,6 +7,9 @@ on:
 jobs:
   npm-update:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
     steps:
       - name: Set up dependencies
         run: |

.github/workflows/npm-update.yml

@@ -7,6 +7,9 @@ on:
 jobs:
   npm-update:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
     steps:
       - name: Set up dependencies
         run: |