[core] Remove default access to GitHub action scopes

Fix https://github.com/mui/material-ui/security/code-scanning/35

.github/workflows/check-if-pr-has-label.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [opened, reopened, labeled, unlabeled]
 
+permissions: {}
+
 jobs:
   test-label-applied:
     # Tests that label is added on the PR

.github/workflows/ci.yml

@@ -8,6 +8,8 @@ on:
       - 'renovate/**'
   pull_request:
 
+permissions: {}
+
 jobs:
   # Tests dev-only scripts across all supported dev environments
   test-dev:

.github/workflows/codeql.yml

@@ -4,6 +4,8 @@ on:
   schedule:
     - cron: '0 2 * * *'
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/maintenance.yml

@@ -1,5 +1,7 @@
 name: Maintenance
 
+permissions: {}
+
 on:
   # So that PRs touching the same files as the push are updated
   push:

.github/workflows/mark-duplicate.yml

@@ -4,6 +4,8 @@ on:
   issue_comment:
     types: [created]
 
+permissions: {}
+
 jobs:
   mark-duplicate:
     runs-on: ubuntu-latest

.github/workflows/no-response.yml

@@ -9,6 +9,8 @@ on:
     # Schedule for five minutes after the hour, every hour
     - cron: '5 * * * *'
 
+permissions: {}
+
 jobs:
   noResponse:
     runs-on: ubuntu-latest

.github/workflows/scorecards.yml

@@ -5,6 +5,8 @@ on:
   schedule:
     - cron: '0 2 * * *'
 
+permissions: {}
+
 jobs:
   analysis:
     name: Scorecards analysis

.github/workflows/support-stackoverflow.yml

@@ -5,6 +5,8 @@ on:
   issues:
     types: [labeled, unlabeled, reopened]
 
+permissions: {}
+
 jobs:
   mark-support:
     runs-on: ubuntu-latest