fix: Move permissions to workflow level for CodeQL SARIF upload

The SARIF upload was failing with "Requires authentication" because
job-level permissions may not be sufficient when the repo's default
token is restricted. Moving permissions to the workflow level ensures
the GITHUB_TOKEN has security-events:write for uploading results.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: nathan-stender

.github/workflows/codeql.yml

@@ -15,18 +15,17 @@ on:
   push:
     branches: [ "main" ]
   pull_request:
-    # The branches below must be a subset of the branches above
     branches: [ "main" ]
 
+permissions:
+  security-events: write
+  contents: read
+  actions: read
+
 jobs:
   analyze:
     name: Analyze
     runs-on: 'ubuntu-latest'
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-      packages: read
 
     strategy:
       fail-fast: false