Harden workflow checkout credential hygiene + permissions (#6545)

* Harden workflow checkout credential hygiene + permissions

Address zizmor static-analysis findings:

- artipacked: add `persist-credentials: false` to actions/checkout
  steps in codeql.yml (2), test-binary-installation.yml (2),
  clang-format-check.yml, freebsd.yml, h5py.yml, openbsd.yml,
  signed-plugins.yml, and update-progress.yml. None of these jobs
  push to git, so dropping the persisted checkout credential is safe.

- excessive-permissions: restrict call-workflows.yml top-level
  permissions to `contents: read`, and grant `packages: write` /
  `pull-requests: write` only on the two jobs that call the
  maven-staging reusable workflow (which declares those needs).

No behavioral change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Removed extra blank lines.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>

.github/workflows/call-workflows.yml

@@ -30,8 +30,6 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
-  pull-requests: write
 
 jobs:
     call-workflow-special-cmake:
@@ -222,6 +220,10 @@ jobs:
     call-maven-staging:
         name: "Maven Staging Tests"
         needs: call-release-cmake
+        permissions:
+            contents: read
+            packages: write
+            pull-requests: write
         uses: ./.github/workflows/maven-staging.yml
         with:
             test_maven_deployment: true
@@ -232,6 +234,10 @@ jobs:
     call-maven-ffm-staging:
         name: "Maven Staging Tests"
         needs: call-ffm-latest-java
+        permissions:
+            contents: read
+            packages: write
+            pull-requests: write
         uses: ./.github/workflows/maven-staging.yml
         with:
             test_maven_deployment: true

.github/workflows/clang-format-check.yml

@@ -12,6 +12,8 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'skip-ci')"
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Run clang-format style check for C and Java code
       uses: DoozyX/clang-format-lint-action@bcb4eb2cb0d707ee4f3e5cc3b456eb075f12cf73 # v0.20

.github/workflows/codeql.yml

@@ -21,6 +21,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+        
       - name: Check for code changes
         uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: filter
@@ -65,6 +68,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Configure HDF5
         run: |

.github/workflows/freebsd.yml

@@ -50,6 +50,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Build and test on FreeBSD
         uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1

.github/workflows/h5py.yml

@@ -16,6 +16,7 @@ jobs:
     - name: Checkout Spack
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        persist-credentials: false
         repository: spack/spack
         path: ./spack
 

.github/workflows/openbsd.yml

@@ -50,6 +50,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Build and test on OpenBSD
         uses: vmactions/openbsd-vm@c941015845c0f0c429676840963dc63b226d4f69

.github/workflows/signed-plugins.yml

@@ -77,6 +77,8 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Install dependencies (Linux)
       if: runner.os == 'Linux'

.github/workflows/test-binary-installation.yml

@@ -73,6 +73,7 @@ jobs:
       - name: Checkout HDF5Examples
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: HDFGroup/HDF5Examples
           path: HDF5Examples
 
@@ -277,6 +278,7 @@ jobs:
       - name: Checkout HDF5Examples
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: HDFGroup/HDF5Examples
           path: HDF5Examples
 

.github/workflows/update-progress.yml

@@ -14,7 +14,9 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        
+      with:
+        persist-credentials: false
+ 
     - name: Set up Python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with: