fix: add explicit permissions blocks to GitHub Actions workflows

Fixes CodeQL alerts #1, #2, #5, #50 (actions/missing-workflow-permissions).
Adds 'permissions: contents: read' to each job to restrict GITHUB_TOKEN
scope and follow the principle of least privilege.

Author: Copilot

.github/workflows/docker-image.yml

@@ -15,6 +15,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     #runs-on: self-hosted
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -74,6 +76,8 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     #runs-on: self-hosted
+    permissions:
+      contents: read
     needs:
       - build
     steps:

.github/workflows/pylint.yml

@@ -17,6 +17,8 @@ jobs:
   lint:
     #runs-on: self-hosted
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: ["3.9", "3.10" , "3.11" , "3.12", "3.13"]

.github/workflows/pytest.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix: