Set permissions for workflows, bump actions/checkout

Found via code scanning:
https://docs.github.com/en/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning

Author: dentarg

.github/workflows/debug.yml

@@ -1,4 +1,6 @@
 name: Debug
+
+permissions: {} # none, https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions
 on:
   push:
   workflow_dispatch:

.github/workflows/release.yml

@@ -1,4 +1,7 @@
 name: Update the v1 branch when a release is published
+
+permissions:
+  contents: write
 on:
   release:
     types: [published]
@@ -7,7 +10,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
     - run: git push origin HEAD:refs/heads/v1

.github/workflows/test.yml

@@ -1,4 +1,7 @@
 name: Test this action
+
+permissions:
+  contents: read
 on:
   pull_request:
   push:
@@ -15,11 +18,10 @@ jobs:
       fail-fast: false
       matrix:
         os: [ ubuntu-22.04, ubuntu-24.04 ]
-
     name: ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - run: psql --version
     - uses: ./
     - run: pg_isready --dbname=$POSTGRES_URL
@@ -30,7 +32,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - uses: ./
       with:
         env-key: DATABASE_URL