ci: update workflows to zizmor 1.2.X (#617)

There is a new zizmor release that requires further hardening of the
permissions in the GH Actions workflows

.github/workflows/cron-nightly-rust.yml

@@ -1,10 +1,15 @@
 name: Update nightly Rust
+
 on:
   schedule:
     - cron: "29 17 1 * *" # At 17:29 on day-of-month 1.
   workflow_dispatch: # allows manual triggering
+
 env:
   CARGO_TERM_COLOR: always
+
+permissions: {}
+
 jobs:
   format:
     name: Update nightly Rustc

.github/workflows/cron-zizmor.yml

@@ -4,6 +4,8 @@ on:
   schedule:
     - cron: "0 0 * * *" # Run every day at midnight
 
+permissions: {}
+
 jobs:
   zizmor:
     name: zizmor latest via PyPI

.github/workflows/dependencies.yml

@@ -25,6 +25,8 @@ env:
     </p>
     </details>
 
+permissions: {}
+
 jobs:
   update:
     name: Update

.github/workflows/docs.yml

@@ -9,6 +9,8 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   docs:
     name: Generate docs

.github/workflows/functional.yml

@@ -8,6 +8,9 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+
+permissions: {}
+
 jobs:
   lint:
     name: Lint test files

.github/workflows/integration.yml

@@ -13,6 +13,8 @@ env:
   RUST_LOG: debug
   RUST_BACKTRACE: full
 
+permissions: {}
+
 jobs:
   test:
     name: Run integration tests and generate report

.github/workflows/lint-actions.yml

@@ -1,4 +1,5 @@
 name: Lint GitHub Actions workflows
+
 on:
   pull_request:
     paths:
@@ -8,6 +9,8 @@ on:
     paths:
       - ".github/**"
 
+permissions: {}
+
 jobs:
   actionlint:
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -9,6 +9,8 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   clippy:
     name: Run clippy on crates

.github/workflows/mutants.yml

@@ -13,6 +13,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   mutants-test:
     name: Generate mutants on diff against default branch and test

.github/workflows/prover.yml

@@ -6,6 +6,8 @@ on:
   push:
     branches: [main]
 
+permissions: {}
+
 jobs:
   eval_perf:
     permissions:
@@ -59,4 +61,3 @@ jobs:
         working-directory: provers/perf
         env:
           RUSTFLAGS: "-C target-cpu=native -C link-arg=-fuse-ld=lld"
-

.github/workflows/security.yml.disabled

@@ -9,6 +9,8 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   supply-chain:
     name: Run `cargo-audit`

.github/workflows/unit.yml

@@ -15,6 +15,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   test:
     name: Run unit tests and generate report

.github/workflows/zizmor.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches: ["**"]
 
+permissions: {}
+
 jobs:
   zizmor:
     name: zizmor latest via PyPI