Give the two workflows without a permissions block the least they need

sha-pinning-check.yml and update-pr-branch.yml ran with the default
GITHUB_TOKEN permissions, which zizmor (excessive-permissions) and
CodeQL (actions/missing-workflow-permissions) both flagged. The pin
check only checks the repository out and reads its workflow files, so
it gets contents: read. update-pr-branch reads and updates the pull
requests with BOT_PAT, the only token the action reads, so the
workflow's own token gets no permissions at all.

Author: abashev

.github/workflows/sha-pinning-check.yml

@@ -6,6 +6,9 @@ on:
   push:
     branches: [ 'main' ]
 
+permissions:
+  contents: read
+
 jobs:
   pin-check:
     runs-on: ubuntu-latest

.github/workflows/update-pr-branch.yml

@@ -7,6 +7,10 @@ on:
     # Run every hour to catch stuck PRs
     - cron: '0 * * * *'
 
+# The action reads and updates the pull requests with BOT_PAT alone, so the workflow's own token needs
+# no permissions.
+permissions: {}
+
 jobs:
   update:
     runs-on: ubuntu-latest