gha-permissions-audit — least-privilege GITHUB_TOKEN blocks, written for you

Every workflow runs with a token. Most repositories never say which one, so the job gets whatever the org default hands out, and a compromised third-party action gets the same. gha-permissions-audit writes the least-privilege permissions block for you and fails CI until it is there.