SEC: disable default gha permissions (2/2) (#377)

Author: neutrinoceros

.github/workflows/pull_from_upstream.yml

@@ -6,6 +6,8 @@ on:
     # Run every Saturday at 0900 UTC
     - cron: '0 9 * * 6'
 
+permissions: {}
+
 jobs:
   sync-workflows:
     if: github.repository != 'OpenAstronomy/github-actions-workflows'