Give read permissions to all remaining GA workflows

This commit is used to address token vulnerabilities
found through the OSSF code scanner
The following GA workflows were updated:
- checkout-cno-ci-repo-job
- checkout-tas-repo-job
- bm-job-exit-trigger

.github/workflows/bm-job-exit-trigger.yaml

@@ -18,6 +18,8 @@ on:
         description: "CNO-CI branch name"
         value: ${{ jobs.exit-trigger.outputs.cno-ci-branch-name  }}
 
+permissions:
+  contents: read
 
 jobs:
   exit-trigger:

.github/workflows/checkout-cno-ci-repo-job.yaml

@@ -21,6 +21,9 @@ on:
         required: true
         description: 'Token required to access the CNO-CI repo'
 
+permissions:
+  contents: read
+
 jobs:
   pull-ci:
     name: Pull ansible based scripts

.github/workflows/checkout-tas-repo-job.yaml

@@ -11,6 +11,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   pull-tas:
     name: Pull TAS code