Backport workflow-hardening fix (excessive-permissions) to 3 release branches

Summary

The default branch already hardened .github/workflows/build-test.yml against the issue(s) below, but 3 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• https://github.com/helm/helm/commit/1a5545737532aa798acc3c58b7adbca53467b76f

Affected release branches (3)

• release-3.16 (still present as of HEAD 7877b45b)
• release-3.14 (still present as of HEAD 81c902a1)
• release-3.15 (still present as of HEAD fa9efb07)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

File .github/workflows/build-test.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -25,3 +25,5 @@
         run: make test-coverage
       - name: Test build
         run: make build
+permissions:
+  contents: read

File .github/workflows/build-test.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -24,3 +24,5 @@
         run: make test-coverage
       - name: Test build
         run: make build
+permissions:
+  contents: read

File .github/workflows/build-test.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -24,3 +24,5 @@
         run: make test-coverage
       - name: Test build
         run: make build
+permissions:
+  contents: read

Happy to open pull requests instead if that's preferred.