Potential fix for code scanning alert no. 10: Workflow does not contain permissions

[gerlero]

Potential fix for https://github.com/gerlero/fronts/security/code-scanning/10

To address the problem, you should add a permissions block to the root of the workflow (near the top of .github/workflows/ci.yml). This will ensure all jobs default to the most restrictive permissions necessary unless specifically overridden per-job. For the tasks in this workflow (linting, typing, testing, building), they generally require only contents: read permissions, as none of the steps (e.g., checkout, code analysis, build) require writing to the repository via the GitHub API. The only step that could sometimes require more is the Codecov upload, but Codecov action works with just contents: read if you provide the Codecov token as you do here.
You should insert the following immediately after the name declaration but before on:

permissions:
  contents: read

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.71%. Comparing base (c443884) to head (58968d6).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #123   +/-   ##
=======================================
  Coverage   75.71%   75.71%           
=======================================
  Files           6        6           
  Lines        1149     1149           
=======================================
  Hits          870      870           
  Misses        279      279           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.