ci: set necessary token permissions (#2960)

* ci(fonts): set token permission to remove label

I've changed [the default permission of the token to read-only](https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/) and this is the only place we need write access.

* ci(codeql): set token permission to upload result

* ci(codeql): set token permission to read actions

.github/workflows/codeql-analysis.yml

@@ -8,6 +8,11 @@ on:
   schedule:
     - cron: '0 0 * * 1'
 
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/fonts.yml

@@ -11,6 +11,9 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'build fonts')
     outputs:
       image: ${{ steps.check-image.outputs.result }}
+    permissions:
+      contents: read
+      pull-requests: write # to remove label
 
     steps:
     - uses: actions/checkout@v2