gha: tweak settings, add testing for "stable" and "oldstable" go

- set default permissions to "content: read" as actions in this repository
  don't require write acccess.
- set a guardrails timeout; this should not be needed normally, but
  GitHub's default timeout is 6 Hours, and prevents runaway actions
  that may happen occasionally on GitHub service outages.
- remove filter for branch name and run on pull-requests, push events
- add "stable" and "oldstable" Go versions to the matrix; these always
  point to the currently maintained versions of Go (currently Go1.25
  and Go1.24). Using the fixed ("oldstable", "stable") keywords reduces
  maintainance and helps marking checks as "required" in branch protection,
  as such options are using the name generated from the matrix.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Author: thaJeztah

.github/workflows/ci.yaml

@@ -1,19 +1,24 @@
 name: CI
 
-on:
-  push:
-    branches: [master]
-  pull_request:
+on: [push, pull_request]
+
+# Default to 'contents: read', which grants actions to read commits. Any
+# permission not included is implicitly set to "none".
+#
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
 
 jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    timeout-minutes: 20 # guardrails timeout
 
     strategy:
       fail-fast: false
       matrix:
-        go: ["1.12", "1.21", "1.22", "1.23"]
+        go: ["1.12", "1.21", "1.22", "1.23", "oldstable", "stable"]
 
     steps:
       - name: Checkout repository
@@ -32,6 +37,7 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 20 # guardrails timeout
 
     steps:
       - name: Checkout repository
@@ -40,7 +46,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
         with:
-          go-version: "1.23"
+          go-version: "stable"
 
       - name: Lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0