Specify permissions for workflows.

.github/workflows/changelog.yml

@@ -1,4 +1,9 @@
 name: "Ensure labels"
+
+permissions:
+  pull-requests: read
+  contents: read
+
 on: # yamllint disable-line rule:truthy
   pull_request:
     types:

.github/workflows/prepare_release.yml

@@ -1,5 +1,9 @@
 name: Prepare release
 
+permissions: 
+  contents: write
+  pull-requests: write
+
 env:
   GIT_AUTHOR_EMAIL: "packages@datadoghq.com"
   GIT_AUTHOR_NAME: "ci.datadog-sync-cli"

.github/workflows/release.yml

@@ -1,5 +1,9 @@
 name: Release
 
+permissions: 
+  contents: write
+  pull-requests: write
+
 on:
   pull_request:
     types: [closed]

.github/workflows/test.yml

@@ -1,5 +1,9 @@
 name: Run Tests
 
+permissions: 
+  checks: write
+  contents: read
+
 on:
   pull_request:
     branches:

.github/workflows/test_integrations.yml

@@ -1,5 +1,9 @@
 name: Run Integrations Tests
 
+permissions: 
+  checks: write
+  contents: read
+
 on:
   pull_request:
     branches: