security: add explicit permissions to CI workflow

Set minimal permissions (contents: read) to limit GITHUB_TOKEN scope

Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

Author: Copilot

.github/workflows/ci.yml

@@ -11,6 +11,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository