Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[deflis]

Potential fix for https://github.com/deflis/node-narou/security/code-scanning/2

To fix the vulnerability, an explicit permissions: block should be added to the workflow to restrict the permissions granted to the GITHUB_TOKEN. As the workflow appears to do only code checkout, install dependencies, build, run test, and report coverage (with no steps that require write access like pushing commits, releases, or issues), the minimal required permission is likely contents: read. The safest fix is to add a permissions: block at the root of the workflow (directly beneath name: and above on:) with contents: read. If the coverage report step ever needs additional permissions (for example, uploading to a PR or creating comments), this may be expanded accordingly, but unless documented, it should start with minimal permissions.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a security vulnerability by adding explicit permissions to the GitHub Actions workflow to restrict the GITHUB_TOKEN permissions following the principle of least privilege.

• Adds a permissions block with minimal contents: read access to the Node.js CI workflow

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}