fix(security): restrict GITHUB_TOKEN to contents:read on heartbeat workflow (#30)

The heartbeat-real-stack workflow lacked an explicit permissions block,
which meant GITHUB_TOKEN inherited the repository default (often
read/write across multiple scopes). Adding a top-level permissions
block scopes the token to the minimum required (contents:read) for
checkout, addressing CWE-275 (Permission Issues).

Closes code-scanning alert: actions/missing-workflow-permissions on
.github/workflows/heartbeat-real-stack.yml:29.

Author: saurabhjain1592

.github/workflows/heartbeat-real-stack.yml

@@ -24,6 +24,9 @@ on:
       - "tests/heartbeat-real-stack/**"
       - ".github/workflows/heartbeat-real-stack.yml"
 
+permissions:
+  contents: read
+
 jobs:
   real-stack:
     name: Real-stack E2E (${{ matrix.os }})