chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#837)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/nightly.yml

@@ -5,13 +5,12 @@ on:
     - cron: "0 0 * * *"
 
 permissions:
-  contents: read
+  contents: write
+  packages: write
 
 jobs:
   create-release:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -146,8 +145,6 @@ jobs:
     needs:
       - create-release
       - generate-metadata
-    permissions:
-      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -206,8 +203,6 @@ jobs:
       - create-release
       - generate-metadata
       - image-build
-    permissions:
-      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -266,8 +261,6 @@ jobs:
     needs:
       - create-release
       - generate-metadata
-    permissions:
-      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -326,8 +319,6 @@ jobs:
       - create-release
       - generate-metadata
       - image-build-arm
-    permissions:
-      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -386,8 +377,6 @@ jobs:
     needs:
       - image-build
       - image-build-arm
-    permissions:
-      packages: write
     steps:
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -427,8 +416,6 @@ jobs:
     needs:
       - image-build-distroless
       - image-build-arm-distroless
-    permissions:
-      packages: write
     steps:
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -468,8 +455,6 @@ jobs:
     needs:
       - binary-build
       - binary-build-arm
-    permissions:
-      contents: write
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:

.github/workflows/release.yml

@@ -6,7 +6,8 @@ on:
       - "v*"
 
 permissions:
-  contents: read
+  contents: write
+  packages: write
 
 jobs:
   generate-metadata:
@@ -116,8 +117,6 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - generate-metadata
-    permissions:
-      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -173,8 +172,6 @@ jobs:
     needs:
       - generate-metadata
       - image-build
-    permissions:
-      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -230,8 +227,6 @@ jobs:
     runs-on: ubuntu-24.04-arm
     needs:
       - generate-metadata
-    permissions:
-      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -287,8 +282,6 @@ jobs:
     needs:
       - generate-metadata
       - image-build-arm
-    permissions:
-      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -345,8 +338,6 @@ jobs:
     needs:
       - image-build
       - image-build-arm
-    permissions:
-      packages: write
     steps:
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -388,8 +379,6 @@ jobs:
     needs:
       - image-build-distroless
       - image-build-arm-distroless
-    permissions:
-      packages: write
     steps:
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -433,8 +422,6 @@ jobs:
     needs:
       - binary-build
       - binary-build-arm
-    permissions:
-      contents: write
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:

.github/workflows/scorecard.yml

@@ -38,6 +38,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4
         with:
           sarif_file: results.sarif

.github/workflows/sponsors.yml

@@ -3,14 +3,12 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
 
 jobs:
   generate-sponsors:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/stale.yml

@@ -4,14 +4,12 @@ on:
     - cron: 0 10 * * *
 
 permissions:
-  contents: read
+  issues: write
+  pull-requests: write
 
 jobs:
   stale:
     runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
     steps:
       - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
         with: