Harden actions. (#1308) (#1309)

(cherry picked from commit 6ae46db845)

Co-authored-by: Felix Fontein <felix@fontein.de>

.github/workflows/docker-images.yml

@@ -43,6 +43,10 @@ jobs:
             tag: check
             tag-as-latest: true
 
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Check out repository
         uses: actions/checkout@v7

.github/workflows/nox.yml

@@ -15,6 +15,9 @@ name: nox
     - cron: '0 9 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # Make sure there is at most one active run per PR, but do not cancel any non-PR runs
   group: ${{ github.workflow }}-${{ (github.head_ref && github.event.number) || github.run_id }}