Potential fix for code scanning alert no. 8: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: DeveloperTryingToCodeLikeOtherOfThem

.github/workflows/tag-bump-commit.yml

@@ -1,6 +1,8 @@
 # ref from pxt-arcade/.github/tag-bump-commit.yml
 
 name: Tag version on merged bump commit
+permissions:
+  contents: read
 
 on:
   workflow_call:
@@ -17,6 +19,7 @@ jobs:
     needs: check-merge
     runs-on: ubuntu-latest
     if: always()
+    permissions: {}
     steps:
       - name: check-merge outputs
         run: |
@@ -27,6 +30,8 @@ jobs:
     needs: check-merge
     if: fromJSON(needs.check-merge.outputs.is_merged_pr || 'false') == true
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     outputs:
       did_tag: ${{ steps.tag-op.outputs.did_tag }}
       tag: ${{ steps.tag-op.outputs.tag }}
@@ -77,6 +82,7 @@ jobs:
     needs: check-merge
     if: fromJSON(needs.check-merge.outputs.is_merged_pr || 'false') == false
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       did_tag: false
     steps:
@@ -86,6 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [tag-version, not-tag-version]
     if: always()
+    permissions: {}
     outputs:
       did_tag: ${{ needs.tag-version.outputs.did_tag || false }}
     steps: