Potential fix for code scanning alert no. 11: Workflow does not contain permissions

[wolfy1339]

Potential fix for https://github.com/octokit/request-error.js/security/code-scanning/11

To fix the problem, we should explicitly add a permissions block to the workflow, setting the minimum required permissions for the GITHUB_TOKEN. Since the existing jobs primarily perform code scanning and do not appear to need write access (such as creating issues or modifying pull requests), the minimal permission should be contents: read. This can be set either at the workflow (root) level (applies to all jobs), or at the job level (applies only to the job). The best approach is to add it at the root, to ensure least privilege for all jobs now and in the future.

Specifically, insert

permissions:
  contents: read

after the name: field and before the on: block in .github/workflows/codeql.yml.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[octokit]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀