GitHub Actions – Updating the default GITHUB_TOKEN permissions to read-only

Previously, GitHub Actions gets a GITHUB_TOKEN with both read/write permissions by default whenever Actions is enabled on a repository.
As a default, this is too permissive, so to improve security we would like to change the default going forward to a read-only token. You can still flip it to read/write if needed.

This change will not impact any existing enterprises, organizations or repositories. Here is how the defaults are set going forward.

1. Enterprises: New enterprises will have read-only token.
2. Organizations owned by Enterprise: New organizations will inherit the permissions from parent enterprise.
3. Organizations not owned by Enterprise: New organizations will have read-only token.
4. Repositories owned by organization: New repositories will inherit permissions from parent organization.
5. Repositories owned by personal account: New repositories will have read-only token.