ci: clarify that cleanup_caches and comment don't use token permissions

.github/workflows/cleanup_caches.yml

@@ -9,6 +9,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {} # uses own token below
+
 jobs:
   cache:
     runs-on: ubuntu-latest

.github/workflows/comment.yml

@@ -9,6 +9,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {} # uses own token below
+
 jobs:
   pr_comment:
     if: github.event.workflow_run.event == 'pull_request' &&

.github/workflows/fuzz.yml

@@ -1,4 +1,5 @@
 name: Pull Request Fuzzing
+
 on:
   pull_request:
     branches: [master]
@@ -12,10 +13,13 @@ on:
         - 'Copyright'
         - 'README.md'
         - 'RELEASE_NOTES'
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+
 permissions: {}
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest