ci: restrict workflow token permissions

[KulmanD]

What changed

• Added a workflow-level permissions block granting only contents: read.
• Applied the restriction to both the Swift test job and release archive matrix.

Why

CodeQL alerts #1 and #2 reported that the workflow relied on GitHub's default GITHUB_TOKEN permissions. Both jobs only need repository read access; artifact upload uses GitHub's artifact runtime service and does not require broad token write permissions.

Validation

• git diff --check
• Workflow YAML parsed successfully with Ruby YAML
• swift build -c release
• GitHub Actions and CodeQL will verify checkout, testing, release archive creation, and artifact upload under the restricted token

Local test limitation

swift test could not load XCTest because the local active developer directory is Command Line Tools and full Xcode is not installed. No source or test code changed.

Risk

Low. The change affects only CI token authorization and intentionally preserves the read access required by actions/checkout.