A site's icon is only ever saved inside the icons folder, and the translations check runs with no token

Fixes the code scanning alerts: a host made of dots got through the file name filter, and
the workflow didn't say it needs no permissions.

.github/workflows/translations.yml

@@ -9,6 +9,9 @@ on:
     paths:
       - "gearslip/src/main/res/values-*/strings.xml"
 
+# It only reads the pull request's own details from the event, so it needs no token at all.
+permissions: {}
+
 jobs:
   weblate-only:
     if: github.event.pull_request.user.login != 'weblate'