ci: declare contents: read on the CI workflow

The 9 jobs in ci.yml (checks, windows-checks, tests, timings, deny,
linux-integration, windows-integration, results) all run actions/checkout
plus build/test steps. None push back to the repo or call write APIs, so
contents: read is the right floor. cover.yml / labeler.yml / publish.yml /
stale.yml in this repo already declare permissions (per-job).

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Author: arpitjain099

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '0 0 * * *' # Every day at midnight
 
+permissions:
+  contents: read
+
 jobs:
   checks:
     name: Checks