Fix various warnings from zizmor (#11639)

.github/workflows/auto-close-stale.yml

@@ -4,14 +4,14 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
-permissions:
-  issues: "write"
-  pull-requests: "write"
-
 jobs:
   auto-close:
     if: github.repository_owner == 'pyca'
     runs-on: ubuntu-latest
+    permissions:
+      issues: "write"
+      pull-requests: "write"
+
     steps:
       - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:

.github/workflows/benchmark.yml

@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         timeout-minutes: 3
         with:
+          persist-credentials: false
           repository: "pyca/cryptography"
           path: "cryptography-base"
           ref: "${{ github.event.inputs.base_commit || github.base_ref }}"

.github/workflows/boring-open-version-bump.yml

@@ -14,6 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          # Needed so we can push back to the repo
+          persist-credentials: true
       - id: check-sha-boring
         run: |
           SHA=$(git ls-remote https://boringssl.googlesource.com/boringssl refs/heads/master | cut -f1)

.github/workflows/lock.yml

@@ -4,13 +4,13 @@ on:
   schedule:
     - cron: '0 3 * * *'
 
-permissions:
-  issues: "write"
-
 jobs:
   lock:
     if: github.repository_owner == 'pyca'
     runs-on: ubuntu-latest
+    permissions:
+      issues: "write"
+
     steps:
       - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:

.github/workflows/x509-limbo-version-bump.yml

@@ -14,6 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          # Needed so we can push back to the repo
+          persist-credentials: true
       - id: check-sha-x509-limbo
         run: |
           SHA=$(git ls-remote https://github.com/C2SP/x509-limbo refs/heads/main | cut -f1)