Set minimum permissions for workflows

Thanks for stopping by to let us know something could be better!

**PLEASE READ**: If you have a support contract with Google, please create an issue in the [support console](https://cloud.google.com/support/) instead of filing on GitHub. This will ensure a timely response.

**Is your feature request related to a problem? Please describe.**
GitHub workflows are [granted high permissions by default](https://docs.github.com/en/actions/security-guides/automatic-token-authentication). Permissions that allow, for example, to delete your source code and publish releases. The permissions can be exploited by malicious actions run in the workflow or malicious PRs if run on `pull_request_target`. This is specially important when using 3P actions such as:
https://github.com/googleapis/google-http-java-client/blob/1acedf75368f11ab03e5f84dd2c58a8a8a662d41/.github/workflows/ci-java7.yaml#L42.

**Describe the solution you'd like**
[Set restricted permissions to run GitHub workflows](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-default-github_token-permissions) or [declare minimum permissions in the workflows](https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs).
e.g. `permissions: contents: read` for workflows that only need to do `actions/checkout`.

**Describe alternatives you've considered**
None.

**Additional context**
My name is Gabriela and I work on behalf of Google and the OpenSSF suggesting supply-chain security changes.

先檢查 .github/workflows 下的工作流程，包括第 42 行附近的 ci-java7.yaml，並將它們的動作與 issue 中連結的 GitHub Actions 權限文件進行比較。找出每個工作流程所需的最小權限，然後確認使用 actions/checkout 的工作流程仍保有必要的讀取存取權，且所有工作流程檔案都遵循預期的限制。

由索引模型根據 Issue 內容生成。