[nrf noup] ci: add default permissions

Scanners report these as missing so lets add them.

Signed-off-by: Kari Hamalainen <[email protected]>

Author: karhama

.github/workflows/commit-tags.yml

@@ -6,6 +6,9 @@ on:
             milestoned, demilestoned, assigned, unassigned, ready_for_review,
             review_requested]
 
+permissions:
+  contents: read
+
 jobs:
   commit_tags:
     runs-on: ubuntu-22.04
@@ -16,7 +19,7 @@ jobs:
         echo "$HOME/.local/bin" >> $GITHUB_PATH
 
     - name: Checkout the code
-      uses: actions/checkout@v3
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0

.github/workflows/manifest-PR.yml

@@ -5,6 +5,8 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
 
 jobs:
   call-manifest-pr-action: