Scope GITHUB_TOKEN permissions per job

[hf-security-analysis]

Workflow hardening

GITHUB_TOKEN permissions scoped per job

A workflow with no permissions: block inherits whatever the repository or the
organization hands out, which is commonly write access to everything. Any step
in that job — including one inside a third-party action — can then push commits,
open releases or edit issues with it.

Each block below grants a job the scopes its own steps need and nothing else.
Jobs that already declared their permissions were left untouched. The
workflow-level permissions: {} is only added once every job in the file
carries its own block, because on its own it would silently strip the jobs it
missed.

Workflow	Job	Granted
.github/workflows/deploy-to-hf.yml	deploy	contents: read
.github/workflows/update-conferences.yml	update-conferences	contents: write, pull-requests: write
.github/workflows/validate-conferences.yml	validate	contents: read

---

Opened by the workflow security bot. It changes what this pull request says it
changes, and nothing else.

[paulinebm]

Approved as part of the org-wide GITHUB_TOKEN permissions campaign.