Set least privileged token permission for GitHub Actions
Other than `golangci-lint.yml`, all other GitHub Actions workflow files have elevated token permissions as demonstrated by the following workflow execution logs.
https://github.com/fatedier/frp/actions/runs/3334432128/jobs/5517384845#step:1:19

This PR mitigates this issue. In addition to this PR, you should consider setting the following permission so that new workflow files will default to read-only permissions
https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository

Signed-off-by: Ashish Kurmi <akurmi@stepsecurity.io>
.github/workflows/goreleaser.yml
name: goreleaser

on:
  workflow_dispatch:

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version: 1.19
          
      - run: |
          # https://github.com/actions/setup-go/issues/107
          cp -f `which go` /usr/bin/go

      - name: Make All
        run: |
          ./package.sh

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v3
        with:
          version: latest
          args: release --rm-dist --release-notes=./Release.md
        env:
          GITHUB_TOKEN: ${{ secrets.GPR_TOKEN }}

name: goreleaser

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version: 1.19
          
      - run: |
          # https://github.com/actions/setup-go/issues/107
          cp -f `which go` /usr/bin/go

      - name: Make All
        run: |
          ./package.sh

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v3
        with:
          version: latest
          args: release --rm-dist --release-notes=./Release.md
        env:
          GITHUB_TOKEN: ${{ secrets.GPR_TOKEN }}

`goreleaser` seems to be using a separate GitHub token (being populated by the `GPR_TOKEN` GitHub secret):
https://github.com/fatedier/frp/blob/dev/.github/workflows/goreleaser.yml#L34

Hence the GitHub Actions generated token doesn't need any write permissions.