Backport workflow-hardening fix (excessive-permissions) to 3 release branches

[CharlieMCY]

Workflow file .github/workflows/changelog-deps.yml on several release branches still triggers a zizmor excessive-permissions finding: the job receives broader default permissions than it needs to commit Dependabot changelog updates.

Commit 5e9a419 on the default branch resolves this by scoping job changelog-update to permissions.contents: write instead of inheriting wider repository token scopes. That workflow may no longer exist on the default branch (it was removed in a later cleanup), but release branches that still run Dependabot changelog automation carry the older pattern.

Three release branches still contain the unfixed workflow as of the noted HEADs:

• branch releases/v2.2.0/fix-upgrade-handler (HEAD 02795698)
• branch releases/v2.0.0 (HEAD 0caad783)
• branch releases/v1.0.3 (HEAD 7ebb9066)

Each branch needs the same minimal hardening applied to job changelog-update in file .github/workflows/changelog-deps.yml: add a job-level permissions block with contents: write so the git-auto-commit step can push without granting excess scopes. Suggested diffs below were checked locally with zizmor and actionlint—the flagged finding clears on the affected construct and no new lint or security findings appear. Whitespace is normalized; only security-relevant lines change.

branch releases/v2.2.0/fix-upgrade-handler — excessive-permissions

File .github/workflows/changelog-deps.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'

--- a/.github/workflows/changelog-deps.yml
+++ b/.github/workflows/changelog-deps.yml
@@ -29,3 +29,5 @@
       - uses: stefanzweifel/git-auto-commit-action@v5
         with:
           commit_message: "Updated changelog - dependabot"
+    permissions:
+      contents: write

branch releases/v2.0.0 — excessive-permissions

File .github/workflows/changelog-deps.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'

--- a/.github/workflows/changelog-deps.yml
+++ b/.github/workflows/changelog-deps.yml
@@ -29,3 +29,5 @@
       - uses: stefanzweifel/git-auto-commit-action@v5
         with:
           commit_message: "Updated changelog - dependabot"
+    permissions:
+      contents: write

branch releases/v1.0.3 — excessive-permissions

File .github/workflows/changelog-deps.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'

--- a/.github/workflows/changelog-deps.yml
+++ b/.github/workflows/changelog-deps.yml
@@ -25,3 +25,5 @@
       - uses: stefanzweifel/git-auto-commit-action@v5
         with:
           commit_message: "Updated changelog - dependabot"
+    permissions:
+      contents: write

Happy to open pull requests against each release branch instead if that is preferred.