Backport workflow-hardening fix (excessive-permissions) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/maven.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 09f9b4e

Affected release branches (5)

• 2.0.33 (still present as of HEAD 61560cc4)
• 2.0.32 (still present as of HEAD aecf48dd)
• 2.0.31 (still present as of HEAD 40cd41f3)
• 2.0.30 (still present as of HEAD 85662bc1)
• 2.0.27 (still present as of HEAD 57ecc50b)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

2.0.33 — excessive-permissions

File .github/workflows/maven.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -57,3 +57,5 @@
         run: |
           ./mvnw clean install -B -q
           echo "done"
+permissions:
+  contents: read

2.0.32 — excessive-permissions

File .github/workflows/maven.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -52,3 +52,5 @@
         run: |
           ./mvnw clean install -B -q
           echo "done"
+permissions:
+  contents: read

2.0.31 — excessive-permissions

File .github/workflows/maven.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -52,3 +52,5 @@
         run: |
           ./mvnw clean install -B -q
           echo "done"
+permissions:
+  contents: read

2.0.30 — excessive-permissions

File .github/workflows/maven.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -52,3 +52,5 @@
         run: |
           ./mvnw clean install -B -q
           echo "done"
+permissions:
+  contents: read

2.0.27 — excessive-permissions

File .github/workflows/maven.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -52,3 +52,5 @@
         run: |
           ./mvnw clean install -B -q
           echo "done"
+permissions:
+  contents: read

---

Happy to open pull requests instead if that's preferred.