Constrain GH Actions workflows permissions (#2625)

.github/workflows/release.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: "0 2 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   init:
     name: Initialize build
@@ -52,6 +55,9 @@ jobs:
   deploy-docker:
     name: Build and publish docker containers
     if: github.repository == 'esphome/esphome'
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs: [init]
     strategy:
@@ -93,6 +99,9 @@ jobs:
 
   deploy-docker-manifest:
     if: github.repository == 'esphome/esphome'
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs: [init, deploy-docker]
     strategy: