Add explicit GITHUB_TOKEN permissions to workflow files

[jhamon]

Summary

• Adds permissions: { contents: read } to 7 workflow files missing explicit permission scoping
• Follows principle of least privilege for GITHUB_TOKEN
• Resolves code scanning alerts Default describe_index_stats response namespaces to empty dict #15, Update pypi distribution docs link and readme #20, updating versions in the license #21, Add pods and pod_type to create_index #23, Revert "Add pods and pod_type to create_index" #24, Revert "Revert "Add pods and pod_type to create_index"" #25, changes to spec for create_index changes #26, add error codes to control plane operations #29, release [dont merge until 2/16] #33, Update index_service.json OpenAPI spec to include enum values for the… #59, Add default value to QueryResponse fields #60, remove numpy, update release workflow #65, Update Code #69, Update Code #70, Copy updates to index_service.json from core repo. #71

Files changed

• testing-dependency-rest.yaml
• testing-dependency-grpc.yaml
• testing-dependency-asyncio.yaml
• testing-dependency.yaml
• cleanup-nightly.yaml
• build-and-publish-docs.yaml
• publish-to-pypi.yaml

Test plan

• Workflow-only change — adds permissions blocks, no logic changes
• CI checks pass on this PR

---

Note

Low Risk
Low risk workflow-only change that tightens default GITHUB_TOKEN access; main risk is an unexpected permissions mismatch causing workflow failures (notably PyPI publishing/tag pushes).

Overview
Adds explicit permissions blocks to several GitHub Actions workflows to follow least-privilege defaults.

Most workflows are scoped to contents: read, while the PyPI release workflow is explicitly granted contents: write to support tagging/pushing during releases.

^{Written by Cursor Bugbot for commit 49b5bf2. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}