Change default permissions for workflows (#5149)

* change default workflow permission to read-all

Fixes #5147

* permission: content read-only

* remove bad changes

.github/workflows/autoroll.yml

@@ -1,4 +1,6 @@
 name: Update dependencies
+permissions:
+  contents: read
 
 on:
   schedule:
@@ -7,6 +9,8 @@ on:
 
 jobs:
   update-dependencies:
+    permissions:
+      contents: write
     name: Update dependencies
     runs-on: ubuntu-latest
 
@@ -38,7 +42,6 @@ jobs:
             echo "changed=true" >> $GITHUB_OUTPUT
           fi
         id: update_dependencies
-     
       - name: Push changes and create PR
         if: steps.update_dependencies.outputs.changed == 'true'
         run: |

.github/workflows/bazel.yml

@@ -1,4 +1,6 @@
 name: Build and Test with Bazel
+permissions:
+  contents: read
 
 on:
   push:

.github/workflows/wasm.yml

@@ -1,4 +1,6 @@
 name: Wasm Build
+permissions:
+  contents: read
 
 on: [push, pull_request]