GitHub Workflows security hardening

[sashashura]

Please check if what you want to add to awesome-go list meets quality standards before sending pull request. Thanks!

Please provide package links to:

• repo link (github.com, gitlab.com, etc):
• pkg.go.dev:
• goreportcard.com:
• coverage service link (codecov, coveralls, gocover etc.):

Note: that new categories can be added only when there are 3 packages or more.

Make sure that you've checked the boxes below that apply before you submit PR.
Not every repository (project) will require every option, but most projects should. Check the Contribution Guidelines for details.

• The package has been added to the list in alphabetical order.
• The package has an appropriate description with correct grammar.
• As far as I know, the package has not been listed here before.
• The repo documentation has a pkg.go.dev link.
• The repo documentation has a coverage service link.
• The repo documentation has a goreportcard link.
• The repo has a version-numbered release and a go.mod file.
• I have read the Contribution Guidelines, Maintainers Note and Quality Standards.
• The repo has a continuous integration process that automatically runs tests that must pass before new pull requests are merged.
• The authors of the project do not commit directly to the repo, but rather use pull requests that run the continuous-integration process.

Thanks for your PR, you're awesome! 👍

---

This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.
It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.

[avelino]

Thank you for contributing with awesome-go, we will revise your contribution as soon as possible.

Automation body links content check:

• godoc.org or pkg.go.dev: True
• goreportcard.com: False
• coverage: True

your project is about to be approved, it's under revision, it may take a few days