ci: restrict ci workflow permissions to read-only

[arpitjain099]

Small hardening change: set permissions: contents: read at the top of .github/workflows/ci.yml so the workflow token is read-only instead of inheriting the repository default. The job only does checkout and build/test, so nothing else is required.

[lxsmnsyc]

lgtm, no downsides?

[arpitjain099]

Right, no downsides. The workflow only checks out the repo and runs the build, so its GITHUB_TOKEN never needs more than read. Declaring contents: read at the top just makes that explicit instead of letting the job inherit whatever the repository default grants (often read/write). If a future job in this file ever needs a write scope, it can be added at the job level without widening the rest.

[arpitjain099]

@lxsmnsyc approved in June and nothing is failing. Is this just waiting on a merge?

[lxsmnsyc]

@arpitjain099 sorry I lost repo perms sometime between June and August (possibly by mistake), we'll resolve this. Thanks for the reminder!

[arpitjain099]

@lxsmnsyc please review when you have time

[lxsmnsyc]

@arpitjain099 This is already approved on my end, however like I mentioned I don't have repo perms anymore. I've also notified @ryansolid but he probably missed it couple of times. Let's wait again.