granular perms / docker-push

ref: https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#authenticating-to-package-registries-with-repository-scoped-permissions

.github/workflows/copycat-db-release.yml

@@ -3,6 +3,9 @@ name: "Release (copycat-db)"
 on:
     workflow_dispatch: # Run manually
 
+permissions:
+    contents: read
+
 jobs:
     build:
         runs-on: ubuntu-latest

.github/workflows/server-publish-ghcr.yml

@@ -7,6 +7,10 @@ on:
     # Run manually if needed to publish out of schedule.
     workflow_dispatch:
 
+permissions:
+    contents: read
+    packages: write
+
 jobs:
     publish:
         runs-on: ubuntu-latest

.github/workflows/server-release.yml

@@ -3,6 +3,9 @@ name: "Release (server)"
 on:
     workflow_dispatch: # Run manually
 
+permissions:
+    contents: read
+
 jobs:
     build:
         runs-on: ubuntu-latest

.github/workflows/web-publish-ghcr.yml

@@ -7,6 +7,10 @@ on:
     # Run manually if needed to publish out of schedule.
     workflow_dispatch:
 
+permissions:
+    contents: read
+    packages: write
+
 jobs:
     publish:
         runs-on: ubuntu-latest