fix(ci): grant actions: read to ci-security caller for v2.1

v2.1 ci-security.yml requests actions: read from callers (vergil-actions#693/#698; v2.1 resolves to v2.1.5). Add actions: read to both the top-level permissions block and the security job's permissions block. Without it the PR fails at startup with 'requesting actions: read, but is only allowed actions: none'.

Refs #316

Author: wphillipmoore

.github/workflows/ci.yml

@@ -26,6 +26,7 @@ on:
 
 permissions:
   contents: read
+  actions: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -98,6 +99,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
+      actions: read
 
   test:
     uses: vergil-project/vergil-actions/.github/workflows/ci-test.yml@v2.1