Add explicit permissions to CI workflow

Sets contents: read at the workflow level to follow least-privilege
principle for GITHUB_TOKEN, resolving CodeQL alert
actions/missing-workflow-permissions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: derek73

.github/workflows/python-package.yml

@@ -10,6 +10,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   build: