ci: declare explicit token permissions in project workflows

.github/workflows/add-to-project.yml

@@ -7,6 +7,8 @@ on:
       - opened
       - reopened
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add to project

.github/workflows/latest-changes.yml

@@ -16,6 +16,10 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   latest-changes:
     runs-on: ubuntu-latest

.github/workflows/test-redistribute.yml

@@ -9,6 +9,9 @@ on:
       - opened
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   test-redistribute:
     runs-on: ubuntu-latest