Repository: prometheus/prometheus (language: go)

Issue:
Add minimum permissions to golangci-lint.yml script, that is being imported and used by other repositories as a GitHub Action
### Proposal

Hi! 

I've contributed to [prometheus/client_golang](github.com/prometheus/client_golang) setting minimal permissions on the GitHub Actions they use (see https://github.com/prometheus/client_golang/issues/1294), but I further realized that some of the changes were reverted. IIUC, the file was reverted due to an automatic sync with a file located in prometheus/prometheus -- please correct me if I've misunderstood anything. Namely, I believe the commit https://github.com/prometheus/client_golang/commit/51d24f86807c24ce866355d0c82258420f571c17 reverted [this file from prometheus/client_golang](https://github.com/prometheus/client_golang/blob/main/.github/workflows/golangci-lint.yml) to be in sync with [this file from prometheus/prometheus](https://github.com/prometheus/prometheus/blob/main/scripts/golangci-lint.yml).

My purpose is that we make the change of minimal permissions directly on the file on prometheus/prometheus in order to keep it secured in every other repository that imports it.

As it's a pretty simple change, I'll take the liberty of raising a PR following up this issue and it should ease your evaluation.


Discussion / hints:

Fix patch:
diff --git a/scripts/golangci-lint.yml b/scripts/golangci-lint.yml
index 805c59fb7cc..4b292229def 100644
--- a/scripts/golangci-lint.yml
+++ b/scripts/golangci-lint.yml
@@ -12,8 +12,14 @@ on:
       - ".golangci.yml"
   pull_request:
 
+permissions:  # added using https://github.com/step-security/secure-repo
+  contents: read
+
 jobs:
   golangci:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
     name: lint
     runs-on: ubuntu-latest
     steps:


Test patch: