It is a good practice to set the github actions default permissions
to the minimum required. The locks action didn't set permissions
explicitly.