ci: fix issues identified by zizmor GHA linter (#3331) (#3335)

(cherry picked from commit 8131b7a)

Co-authored-by: Maxwell G <9920591+gotmax23@users.noreply.github.com>

Author: oraNod

.github/workflows/ci.yaml

@@ -11,6 +11,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   nox:
     uses: ./.github/workflows/reusable-nox.yml

.github/workflows/labeler.yml

@@ -24,6 +24,9 @@
 
 name: "Triage Issues and PRs"
 
+permissions:
+  contents: read
+
 jobs:
   label_prs:
     runs-on: ubuntu-latest
@@ -43,6 +46,8 @@ jobs:
           private-key: ${{ secrets.BOT_APP_KEY }}
       - name: Checkout parent repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install Python 3.11
         uses: actions/setup-python@v5
         with:

.github/workflows/reusable-nox.yml

@@ -36,6 +36,8 @@ jobs:
     steps:
       - name: Check out repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup nox
         uses: wntrblm/nox@2025.10.16
         with: