test: limit permissions in github actions

Automatic PR from app.stepsecurity.io (initiated by BlaineEXE) to limit 
permissions in github actions to only those needed.

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

.github/workflows/commitlint.yml

@@ -16,8 +16,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for wagoid/commitlint-github-action to get commits in PR
     runs-on: ubuntu-20.04
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}