Potential fix for code scanning alert no. 8: Workflow does not contain permissions

[achamayou]

Potential fix for https://github.com/microsoft/merklecpp/security/code-scanning/8

In general, the fix is to add an explicit permissions: block either at the workflow root (applies to all jobs) or at the job level (applies only to that job), restricting GITHUB_TOKEN to the least privileges required. This workflow only checks out code and runs build/test commands, so contents: read is sufficient.

The minimal and clearest change, without altering functionality, is to add a workflow-level permissions: block after the on: section and before jobs: in .github/workflows/ci.yml:

• Add:

  permissions:
    contents: read

  at the root level of the workflow file (same indentation as on: and jobs:).

No additional methods, imports, or definitions are needed; this is purely a YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.