Rule suggestion: Explicit permissions for jobs

[jessehouwing]

For security it's better if people use least privilege. I'd love a set of rules to select minimal permissions.

For workflows with multiple jobs, set top level permissions to none

permissions: {}

and require specific permissions per job

jobs:
  job-name:
    permissions: read-all 

For workflows with a single job, this might be overkill and could set the permissions at top level, instead of job level.