Additional workflow permissions tweaks

Signed-off-by: Eddie Knight <knight@linux.com>

.github/workflows/release-manifests.yml

@@ -8,11 +8,11 @@ permissions:
   contents: read
 
 jobs:
-  permissions:
-    id-token: write # needed for keyless signing
-    packages: write # needed for ghcr access
   build-push:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # needed for keyless signing
+      packages: write # needed for ghcr access
     steps:
       - uses: actions/checkout@v3
       - name: Setup Kustomize

.github/workflows/release.yaml

@@ -5,9 +5,7 @@ on:
     tags: [ 'v*' ]
 
 permissions:
-  contents: write # needed to write releases
+  contents: read
-  id-token: write # needed for keyless signing
-  packages: write # needed for ghcr access
 
 jobs:
   goreleaser:

.github/workflows/scan.yaml

@@ -51,10 +51,10 @@ jobs:
           sarif_file: snyk.sarif
 
   codeql:
-    permissions:
-      security-events: write # for codeQL to write security events
     name: CodeQL
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write # for codeQL to write security events
     if: github.actor != 'dependabot[bot]'
     steps:
       - name: Checkout repository