Set CI jobs to only be allowed to read the repo contents

.github/workflows/ci.yaml

@@ -4,6 +4,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: ${{ matrix.name }}