fix(ci): scope job permissions in workflows flagged on #15046

.github/workflows/issue_labeler.yml

@@ -4,12 +4,13 @@ on:
   issues:
     types: [opened]
 
-permissions:
-  contents: read
-  issues: write
+permissions: {}
 
 jobs:
   label:
+    permissions:
+      contents: read
+      issues: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

.github/workflows/pr_labeler.yml

@@ -4,12 +4,13 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   label:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13  # v7.0.0
@@ -17,6 +18,9 @@ jobs:
           sync-labels: true
 
   missing-tests:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -50,6 +54,9 @@ jobs:
           fi
 
   fixes-issue:
+    permissions:
+      issues: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Check for linked closing issues
@@ -85,6 +92,8 @@ jobs:
           fi
 
   size-label:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Label PR by diff size