Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[ProgrammerKR]

Potential fix for https://github.com/ProgrammerKR/ProXPL/security/code-scanning/2

To fix the problem, add an explicit permissions block that grants only the minimum required access. This workflow checks out code, builds, runs benchmarks, and uploads artifacts. None of these actions require write access to repository contents or other GitHub resources, so contents: read is sufficient and is the commonly recommended baseline.

The best minimal change is to add a top‑level permissions block (applied to all jobs) with contents: read. This preserves all existing behavior because:

• actions/checkout works with contents: read.
• actions/upload-artifact does not rely on repository write permissions; it uses internal artifact APIs.
  No other steps call GitHub APIs.

Concretely, in .github/workflows/build.yml, insert:

permissions:
  contents: read

at the root level, between the on: block and env: block (e.g., after line 7). No additional imports, methods, or definitions are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.