CI: run on push to main and set least-privilege GITHUB_TOKEN permissions (#546)

Add a push trigger on main so the full CI matrix (lint, unit, integration)
re-runs on merge, matching dropbox-sdk-dotnet; previously ci.yml only ran on
pull_request, so main could break undetected.

Also add a top-level `permissions: contents: read` to ci.yml, coverage.yml,
and spec_update.yml to satisfy the CodeQL missing-workflow-permissions alert.
Jobs that need OIDC keep their job-level id-token: write override; spec_update
creates PRs via the SPEC_UPDATE_TOKEN PAT, not GITHUB_TOKEN.

Author: AndreyVMarkelov

.github/workflows/ci.yml

@@ -1,7 +1,13 @@
 name: CI
 on:
+  push:
+    branches:
+      - main
   pull_request:
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   CI:
     runs-on: ${{ matrix.os }}

.github/workflows/coverage.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: 0 0 * * *
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   Coverage:
     runs-on: ubuntu-latest

.github/workflows/spec_update.yml

@@ -4,6 +4,9 @@ on:
   repository_dispatch:
     types: [spec_update]
 
+permissions:  # least privilege; PR creation uses the SPEC_UPDATE_TOKEN PAT
+  contents: read
+
 jobs:
   Update:
     runs-on: ubuntu-latest