fix(ci): add packages: read permission and GITHUB_TOKEN fallback for npm.pkg.github.com auth

widget-sdk 3.18.0 is published on GitHub Packages (npm.pkg.github.com) unlike
3.17.0 which was on the public npm registry. CI needs read:packages permission
to download it. Add explicit packages: read permission to the job and fall back
to GITHUB_TOKEN when STAFFBOT_NPM_READ is unavailable.

Co-authored-by: GitHub Copilot <copilot@noreply.github.com>

Author: maximizeIT

.github/workflows/ci.yaml

@@ -10,6 +10,10 @@ jobs:
   executing-tests:
     runs-on: ubuntu-22.04
 
+    permissions:
+      contents: read
+      packages: read
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -27,7 +31,7 @@ jobs:
         working-directory:  samples/weather-forecast
         run: yarn install --frozen-lockfile
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.STAFFBOT_NPM_READ }}
+          NODE_AUTH_TOKEN: ${{ secrets.STAFFBOT_NPM_READ || secrets.GITHUB_TOKEN }}
 
       - name: Run Build
         working-directory: samples/weather-forecast