ci: declare least-privilege workflow-level contents: read (#149)

ci: declare workflow-level contents: read on 1 workflow

Declares an explicit workflow-level permissions: contents: read on 1 workflow that currently inherit the default broad read-write GITHUB_TOKEN. Each file was inspected and only reads the checkout; none publish, push, or write via the GitHub API. Post-CVE-2025-30066 hardening default.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Author: arpitjain099

.github/workflows/social-rfc-update.yml

@@ -3,6 +3,10 @@ on:
   # Can't use pull_request because it won't have access to secrets
   pull_request_target:
     types: [labeled, closed]
+
+permissions:
+  contents: read
+
 jobs:
   tweetStateChange:
     runs-on: ubuntu-latest