Merge pull request #21366 from evverx/ci-follow-ups-3

ci: LGPLv2+ify dependapot config and codeql action and tighten codeql and labeler even more

.github/dependabot.yml

@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
 version: 2
 updates:
   - package-ecosystem: "github-actions"

.github/workflows/codeql-analysis.yml

@@ -1,3 +1,7 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
 name: "CodeQL"
 
 on:
@@ -7,6 +11,9 @@ on:
   schedule:
     - cron: '0 1 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -16,7 +23,6 @@ jobs:
       cancel-in-progress: true
     permissions:
       actions: read
-      contents: read
       security-events: write
 
     strategy:

.github/workflows/labeler.yml

@@ -9,11 +9,12 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   triage:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
     - uses: actions/labeler@69da01b8e0929f147b8943611bee75ee4175a49e
       with: