ci: set least-privilege GITHUB_TOKEN permissions for meson workflow

The meson workflow only builds and tests across platforms; none of its
jobs write to the repository, packages, or other GitHub resources. Add a
workflow-level `permissions: { contents: read }` block so the default
GITHUB_TOKEN follows least privilege instead of inheriting the broad
read/write scopes granted by default.

diff --git a/.github/workflows/meson.yml b/.github/workflows/meson.yml
index 8edad3312d798cb36ed998942ed3b8cb48f772e2..d85e8762cb92a574f1b3f7df40dc9914a7f6426a 100644 (file)
--- a/.github/workflows/meson.yml
+++ b/.github/workflows/meson.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${{github.workflow}}-${{github.head_ref}}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   Linux-GCC:
     runs-on: ubuntu-22.04