ci(codeapi): set minimum workflow token permissions to contents: read (#2102) (#2)

* ci(codeapi): set minimum workflow token permissions to contents: read (#2102)

Source: ClickHouse/ai@f0093f4b52a8da08092d4da4a7157b7ca30cd8ec

* ci(codeapi): pin GitHub Actions to commit SHAs (#2266)

Source: ClickHouse/ai@b2c75e3b9722b7e5f1059eb19654411844f782f5

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

.github/workflows/ci.yml

@@ -14,6 +14,9 @@ on:
     branches: [main, 'sync/**']
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref_name }}
   cancel-in-progress: true