ci: add least-privilege permissions to remaining workflows

[bmehta001]

What

Adds top-level permissions: { contents: read } to the six sister workflows that lacked an explicit GITHUB_TOKEN scope, scoping the token to the minimum needed for actions/checkout.

File	Job purpose	Scope
build-android.yml	Android build + artifact upload	contents: read
build-ios-mac.yml	iOS/macOS build matrix	contents: read
build-posix-latest.yml	Linux/Mac build matrix	contents: read
build-ubuntu-2204.yml	Ubuntu 22.04 build	contents: read
build-windows-vs2022.yaml	Visual Studio 2022 build	contents: read
test-win-latest.yml	Windows unit/functional tests	contents: read

Why

Carry-forward from #1450 (which hardened spellcheck.yml). Without an explicit permissions: block, GITHUB_TOKEN inherits the repo default — broader than needed. None of these jobs:

• Post PR comments or status updates.
• Deploy artifacts via the token (actions/upload-artifact@v4 uses its own per-run SAS, not GITHUB_TOKEN).
• Write to releases, packages, or pages.

So contents: read (just enough for actions/checkout@v4) is sufficient everywhere.

Each comment also names the CodeQL rule it satisfies (actions/missing-workflow-permissions) if Actions language analysis is later added to this repo's codeql-analysis.yml matrix — currently it's [cpp, javascript, python] + Java only, which is why these don't appear as code-scanning alerts today.

Mirrors the analogous modules-repo commit decc96501 (in modules PR #320), which closed 4 outstanding missing-workflow-permissions alerts there.

Not touched

• codeql-analysis.yml and deploy-docs-pages.yml — already have explicit permissions: blocks.
• spellcheck.yml — already being hardened in ci(spellcheck): pin misspell + add least-privilege permissions #1450 (don't want to conflict).
• .off files — disabled by extension, not active workflows.

Validation

• All six files YAML-parse cleanly with permissions: {contents: read} at the top level.
• No behavior change: triggers, jobs, runners, steps unchanged.
• Per-file line-ending convention preserved (build-android.yml was CRLF upstream; rest are LF; my blobs match).
• Existing CI on this branch will exercise the workflows and confirm the token scope still allows checkout.

References

• Sister PR ci(spellcheck): pin misspell + add least-privilege permissions #1450 — spellcheck.yml hardening (same pattern)
• Modules PR Android ext.app.id may benefit from A: prefix #320 — equivalent hardening, including alert closures

[Copilot]

Pull request overview

Adds top-level least-privilege permissions: { contents: read } blocks to six CI workflows that previously inherited the repo default GITHUB_TOKEN scope. None of these workflows post comments, publish releases/packages, or write via the token, so contents: read is sufficient for actions/checkout. This mirrors the hardening pattern from PR #1450 (spellcheck) and modules PR #320.

Changes:

• Add permissions: { contents: read } top-level block to six workflows.
• Add explanatory comments referencing the CodeQL actions/missing-workflow-permissions rule.
• No changes to triggers, jobs, runners, or steps.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/build-android.yml	Adds least-privilege permissions block before concurrency:
.github/workflows/build-ios-mac.yml	Adds least-privilege permissions block before concurrency:
.github/workflows/build-posix-latest.yml	Adds least-privilege permissions block before concurrency:
.github/workflows/build-ubuntu-2204.yml	Adds least-privilege permissions block before concurrency:
.github/workflows/build-windows-vs2022.yaml	Adds least-privilege permissions block before jobs:
.github/workflows/test-win-latest.yml	Adds least-privilege permissions block before concurrency:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.