False positive: Workflow does not contain permissions

**Description of the false positive**

We get a lot of `Workflow does not contain permissions` alerts.

It's description states

> If a GitHub Actions job or workflow has no explicit permissions set, then the repository permissions are used. Repositories created under organizations inherit the organization permissions. The organizations or repositories created before February 2023 have the default permissions set to read-write. Often these permissions do not adhere to the principle of least privilege and can be reduced to read-only, leaving the write permission only to a specific types as issues: write or pull-requests: write.

While our org was created before February 2023, the default permission on the org is set to read contents and packages only, and in the repository I can't even change the setting.

**Code samples or links to source code**

https://github.com/intility/templates/blob/8653a13809c06c5046e57cb689d8479726380414/.github/workflows/build-react.yml#L13-L36

**URL to the alert on GitHub code scanning (optional)**

https://github.com/intility/templates/security/code-scanning/4

Beginne mit dem verlinkten Workflow unter .github/workflows/build-react.yml, Zeilen 13–36, und vergleiche dessen Berechtigungen mit dem gemeldeten code-scanning alert. Bestimme anhand der Standardwerte für Organisation und Repository, ob der Alert ein False Positive ist, und überprüfe anschließend, ob das Verhalten des Alerts oder das Abfrageergebnis dem dokumentierten Berechtigungsmodell entspricht.

Vom Indexierungsmodell aus dem Issue-Text verfasst.