docs: apply deny-by-default permissions to all README examples (#425)

* docs: add top-level permissions: {} to secret-scan example

Completes the per-job permissions pattern by denying all permissions at
the workflow level by default, then granting only contents: read to the
trufflehog job. Prevents consumers of the reusable workflow from
inheriting permissive GITHUB_TOKEN defaults.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: add top-level permissions: {} to all README examples

Applies deny-by-default permissions at the workflow level across every
template example (intro + 17 workflows). Per-job permissions already
existed and were left unchanged.

GitHub does not auto-zero workflow-level permissions when job-level
permissions are set; jobs without their own block still inherit the
workflow-level scope (or the repo default, often write-all). The
top-level {} ensures that any job without an explicit permissions block
gets nothing instead of the repo default, protecting consumers against
future job additions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: timdittler

README.md

@@ -9,6 +9,8 @@ You can find all possible template workflows in the directory `.github/workflows
 ```yml
 name: <your name>
 
+permissions: {}
+
 on: ...
 
 jobs:
@@ -38,6 +40,8 @@ At Staffbase, [staffbase-actions](https://github.com/apps/staffbase-actions) is
 ```yml
 name: Enable Dependabot Auto-Merge
 
+permissions: {}
+
 on:
   pull_request:
 
@@ -68,6 +72,9 @@ jobs:
 
 ```yml
 name: Autodev
+
+permissions: {}
+
 on:
   push:
     branches-ignore:
@@ -117,6 +124,9 @@ jobs:
 
 ```yml
 name: Changeset Check
+
+permissions: {}
+
 on:
   pull_request:
     types: [opened, reopened, synchronize]
@@ -141,6 +151,8 @@ jobs:
 ```yml
 name: Release Changesets
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -181,6 +193,8 @@ jobs:
 ```yml
 name: Find flaky tests
 
+permissions: {}
+
 on:
   # At 05:00 on Monday.
   schedule:
@@ -221,6 +235,9 @@ jobs:
 
 ```yml
 name: GitOps
+
+permissions: {}
+
 on: [push]
 
 jobs:
@@ -308,6 +325,9 @@ Then the jira issues will be updated with a release date and the labels will be
 
 ```yml
 name: Annotate Jira Issues
+
+permissions: {}
+
 on:
   push:
     tags: ['**']
@@ -342,6 +362,9 @@ The action can be used to collect and push code references for LaunchDarkly feat
 
 ```yml
 name: Find LaunchDarkly flag code references
+
+permissions: {}
+
 on:
   push:
     branches:
@@ -370,6 +393,8 @@ jobs:
 ```yml
 name: Merge Block
 
+permissions: {}
+
 on:
   pull_request:
     types: [opened, labeled, unlabeled]
@@ -399,6 +424,8 @@ More information on how to configure this file can be found [here](https://githu
 ```yml
 name: Release Drafter
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -447,6 +474,8 @@ You can remove all other version resolver from your configuration.
 ```yml
 name: Release Version Detector
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -487,13 +516,15 @@ on:
 ```yml
 name: Secret Scan
 
+permissions: {}
+
 on: [pull_request]
 
 jobs:
   trufflehog:
-    uses: Staffbase/gha-workflows/.github/workflows/template_secret_scan.yml@963c984dde02b0a8711f0d098aa9f8a7f2e50bca # v12.0.1
     permissions:
       contents: read
+    uses: Staffbase/gha-workflows/.github/workflows/template_secret_scan.yml@963c984dde02b0a8711f0d098aa9f8a7f2e50bca # v12.0.1
 ```
 
 </details>
@@ -506,6 +537,8 @@ jobs:
 ```yml
 name: Stale PRs
 
+permissions: {}
+
 on:
   schedule:
     - cron: '0 0 * * 1-5'
@@ -542,6 +575,8 @@ jobs:
 ```yml
 name: TechDocs
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -573,6 +608,8 @@ jobs:
 ```yml
 name: TechDocs
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -612,6 +649,8 @@ jobs:
 ```yml
 name: Terraform
 
+permissions: {}
+
 on: [pull_request]
 
 jobs:
@@ -643,6 +682,8 @@ jobs:
 ```yml
 name: YAMLlint
 
+permissions: {}
+
 on:
   push:
     branches: