[ci] Explicitly declare permissions and limit credentials (#15324)

Authored by: bashonly

.github/workflows/challenge-tests.yml

@@ -16,8 +16,8 @@ on:
       - yt_dlp/extractor/youtube/jsc/**.py
       - yt_dlp/extractor/youtube/pot/**.py
       - yt_dlp/utils/_jsruntime.py
-permissions:
-  contents: read
+
+permissions: {}
 
 concurrency:
   group: challenge-tests-${{ github.event.pull_request.number || github.ref }}
@@ -26,6 +26,8 @@ concurrency:
 jobs:
   tests:
     name: Challenge Tests
+    permissions:
+      contents: read
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -36,6 +38,8 @@ jobs:
       QJS_VERSION: '2025-04-26'  # Earliest version with rope strings
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6
       with: