Limit CI workflow token permissions

Grant the CI workflow read-only repository contents access to resolve the CodeQL missing-workflow-permissions alert.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: aarongustafson

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest