fix(ci): add explicit permissions to workflows missing them

Resolves code scanning alerts #1, #2, #3 (actions/missing-workflow-permissions)
by adding `permissions: contents: read` to the three workflows that lacked
a top-level permissions block, following the principle of least privilege.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rhuanbarreto

.github/workflows/code-pull-request.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/update-lock.yaml

@@ -6,9 +6,13 @@ on:
     paths:
       - "package.json"
       - ".github/workflows/update-lock.yaml"
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
+
 jobs:
   update-lock:
     name: Update Package Lock

.github/workflows/windows-smoke-test.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true