ci: add permissions and persist-credentials checkout option

Author: Linkid

.github/workflows/build.yml

@@ -6,13 +6,18 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   firefox:
     name: Build the extension for Firefox
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

.github/workflows/lint.yml

@@ -1,12 +1,17 @@
 name: Lint
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0