chore: CI permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: benbrandt

.github/workflows/codex-update.yml

@@ -5,6 +5,10 @@ on:
     - cron: '0 5 * * *' 
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: read
+
 env:
   CODEX_PACKAGE: '@openai/codex'
   CODEX_UPDATE_LABEL: 'codex-update'