fix(CI): Code scanning alert: Workflow does not contain permissions

[ScottBrenner]

Changes:

The recommended fix is to add a permissions block specifying least-privilege access. In this context, since the job only checks out code, builds, runs containers, and uploads artifacts—none of which require write access to repository contents—contents: read is sufficient. The permissions block should be added at the workflow root (top-level, after the name and before on or jobs), or to the specific job if fine-grained control is needed. For this CI workflow, placing it at the root improves clarity and applies least-privilege to all jobs. No new imports or definitions are necessary; this is a YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Generated by https://docs.github.com/en/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning#about-copilot-autofix-for-code-scanning

• I have read and agreed to the Code of Conduct.
• I have read and complied with the contributing guidelines.
• What I'm implementing was an approved issue.
• I have tested all of my changes.

[binaryoverload]

Looks good, thanks!