Limit token permissions in GitHub workflows (#440)

See
https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#token-permissions

.github/workflows/integ-test-cache-cleanup.yml

@@ -18,6 +18,9 @@ env:
   # Requires a fresh cache entry each run
   GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: cache-cleanup-${{ inputs.cache-key-prefix }}-${{github.run_number}}
 
+permissions:
+  contents: read
+
 jobs:
   cache-cleanup-full-build:
     strategy: