ci: restrict GITHUB_TOKEN to contents: read

The CI workflow had no permissions block, so every job inherited the
repository default token scope. No job uses GITHUB_TOKEN, and the action
uploads with CODSPEED_TOKEN.

Author: not-matthias

.github/workflows/ci.yml

@@ -11,6 +11,9 @@ on:
       - "**.md"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test-action:
     strategy: