Added explicit permissions to check-run (#406)

Author: mandreko-bitwarden

.github/workflows/_ephemeral_environment_manager.yml

@@ -41,6 +41,8 @@ jobs:
   check-run:
     name: Check PR run
     uses: ./.github/workflows/check-run.yml
+    permissions:
+      contents: read
 
   create-branch:
     name: Create Branch

.github/workflows/scan.yml

@@ -14,10 +14,14 @@ on:
     branches:
       - "main"
 
+permissions: {}
+
 jobs:
   check-run:
     name: Check PR run
     uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+    permissions:
+      contents: read
 
   sast:
     name: SAST scan