chore(ci): Follow up to workflow permissions (#11397)

Following up with more tinkering of the workflow permissions.

I'll have to just test the publishing ones by merging and watching it
not break.

Author: Josh-Walker-GM

.github/workflows/check-test-project-fixture.yml

@@ -41,8 +41,6 @@ jobs:
     if: needs.detect-changes.outputs.code == 'true'
     name: Check test project fixture
     runs-on: ubuntu-latest
-    permissions:
-      actions: write
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 

.github/workflows/ci.yml

@@ -11,6 +11,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
   YARN_ENABLE_HARDENED_MODE: 0

.github/workflows/publish-canary.yml

@@ -14,6 +14,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   publish-canary:
     name: 🦜 Publish Canary

.github/workflows/publish-release-candidate.yml

@@ -14,6 +14,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check-git-tags:
     name: 🏷 Check git tags