[StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

.github/workflows/check.yml

@@ -6,6 +6,9 @@ on:
   merge_group:
     branches:
     - main
+permissions:
+  contents: read
+
 jobs:
   rustfmt:
     name: rustfmt

.github/workflows/release-plz.yml

@@ -6,6 +6,9 @@ on:
 concurrency:
   group: "${{ github.workflow }}"
   cancel-in-progress: true
+permissions:
+  contents: read
+
 jobs:
   release-plz:
     name: release-plz

Cargo.lock

@@ -593,9 +593,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.44.2"
+version = "1.42.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
+checksum = "5cec9b21b0450273377fc97bd4c33a8acffc8c996c987a7c5b319a0083707551"
 dependencies = [
  "backtrace",
  "bytes",
@@ -611,9 +611,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",

Cargo.toml

@@ -33,7 +33,7 @@ thiserror = "2.0.9"
 xz2 = "0.1"
 
 [workspace.dependencies.tokio]
-version = "1.44.2"
+version = "1.41.1"
 features = ["full"]
 
 [workspace.dependencies.uuid]