Internal: Restrict permissions for Github actions (triggered by PRs)

.github/workflows/php.yml

@@ -2,6 +2,9 @@ name: Behat tests 1.11.x 🐞
 
 on: [push, pull_request]
 
+permissions:
+    contents: read
+
 jobs:
     build:
         name: PHP ${{ matrix.php-versions }} Test on ${{ matrix.operating-system }}

.github/workflows/php_cs.yml

@@ -2,6 +2,9 @@ name: PHP-CS-Fixer
 
 on: [ push, pull_request ]
 
+permissions:
+    contents: read
+
 jobs:
   composer_install:
     runs-on: ubuntu-20.04