ci: declare least-privilege permissions on the remaining 11 workflows

[arpitjain099]

This repo already has explicit permissions: blocks on the major workflows (codeql-analysis.yml, golangci-lint.yml, hotfix-generate.yml, labeler.yaml, pr-lint.yaml, tidy.yaml, etc.). This PR finishes the job by adding scoped permissions to the 11 remaining workflows so none of them implicitly inherit a write-capable GITHUB_TOKEN.

The bulk of the changes are permissions: contents: read because the workflows just lint, vet, or test against a checkout:

• go-test.yml, no-sudo-check.yml, shellcheck.yml, shellspec.yaml
• validate-components.yml, validate-image-version.yml
• validate-windows-binary-signature.yaml, validate-windows-ut.yml

Three workflows get a different scope because they actually do something with a token:

• auto-update.yml invokes tibdex/auto-update@v2 with secrets.GITHUB_TOKEN to refresh PR branches off main, so it gets contents: write + pull-requests: read.
• generate-kubelet-flags.yaml performs its push + PR creation using secrets.PERSONAL_ACCESS_TOKEN (an explicit user PAT, not the default token). The default GITHUB_TOKEN only needs contents: read for the checkout; an inline comment was added documenting that.
• validate-pull-request-source.yml doesn't even check out the repo; it only inspects github.event.pull_request.head.repo.full_name. permissions: {} (deny all) is the most accurate.

Each edited file was validated with python3 -c "import yaml; yaml.safe_load(...)".

[Copilot]

Pull request overview

This PR completes the repository’s move to explicit least-privilege GITHUB_TOKEN scopes by adding top-level permissions: blocks to the remaining GitHub Actions workflows that previously relied on default token permissions.

Changes:

• Added permissions: contents: read to workflows that only need to check out the repo and run lint/vet/test/validation jobs.
• Set permissions: {} on validate-pull-request-source.yml since it only reads pull_request event metadata and does not use the token.
• Granted auto-update.yml the minimal write scope it needs (contents: write) plus pull-requests: read; documented that generate-kubelet-flags.yaml uses a PAT for push/PR creation so GITHUB_TOKEN can remain read-only.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/validate-windows-ut.yml	Adds contents: read permissions for a checkout + Windows Pester tests workflow.
.github/workflows/validate-windows-binary-signature.yaml	Adds contents: read permissions for Windows file/signature checks that require checkout only.
.github/workflows/validate-pull-request-source.yml	Denies all token permissions ({}) since it only inspects PR event metadata (no checkout/API).
.github/workflows/validate-image-version.yml	Adds contents: read permissions for a checkout + make-based validation workflow.
.github/workflows/validate-components.yml	Adds contents: read permissions for schema validation and Go-based consistency/compatibility checks.
.github/workflows/shellspec.yaml	Adds contents: read permissions for checkout + ShellSpec unit tests.
.github/workflows/shellcheck.yml	Adds contents: read permissions for checkout + ShellCheck linting.
.github/workflows/no-sudo-check.yml	Adds contents: read permissions for checkout + grep-based validation.
.github/workflows/go-test.yml	Adds contents: read permissions for checkout + Go unit tests.
.github/workflows/generate-kubelet-flags.yaml	Sets contents: read and documents that push/PR creation uses a PAT (not GITHUB_TOKEN).
.github/workflows/auto-update.yml	Grants contents: write and pull-requests: read for the auto-update action to update PR branches.