ci: scope workflow permissions to jobs

.github/workflows/issue_labeler.yml

@@ -1,7 +1,6 @@
 ---
 name: Issue labeler
-permissions:
-  contents: read
+permissions: {}
 
 on:
   issues:
@@ -14,7 +13,7 @@ jobs:
   label-component:
     runs-on: ubuntu-latest
     permissions:
-      issues: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

.github/workflows/top_issues.yml

@@ -1,5 +1,6 @@
 ---
 name: Top issues
+permissions: {}
 
 on:
   schedule:
@@ -10,13 +11,13 @@ concurrency:
   group: 'top-issues'
   cancel-in-progress: true
 
-permissions:
-  contents: read
-  issues: write
 
 jobs:
   top-issues:
     name: Top issues
+    permissions:
+      contents: read
+      issues: write
     runs-on: ubuntu-latest
     steps:
       - name: Top issues action

.github/workflows/update_issue_templates.yml

@@ -1,7 +1,6 @@
 ---
 name: Update Repositories List in Roadmap
-permissions:
-  contents: read
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -13,19 +12,15 @@ on:
   schedule:
     - cron: '0 0 * * *'
   pull_request:
-    branches:
-      - master
-    types:
-      - opened
-      - reopened
-      - synchronize
   push:
     branches:
       - master
 
 jobs:
   update-repositories:
     name: Update Repository List
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout