fix: address GitHub code scanning and secret scanning alerts

- Add `permissions: contents: read` (+ `security-events: write` for CI)
  to all four workflow files so they run with least-privilege tokens
  instead of the default over-broad GITHUB_TOKEN permissions.
- Sanitize `context.Request.Path` before logging in
  ExceptionHandlingMiddleware to prevent log-forging via CR/LF injection.
- Dismiss false-positive CodeQL alerts: #13 (AuthController UserId log
  is not PII) and #10 (ImageUploadModal preview is a blob URL, not HTML).
- Dismiss secret-scanning alerts #4/#5/#6: Firebase API keys are
  intentionally public and restricted via Firebase Security Rules /
  Google Cloud Console; they are not server-side credentials.

Author: Yuval

.github/workflows/cd.yml

@@ -31,6 +31,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: cd-${{ github.ref }}
   cancel-in-progress: false   # Don't cancel in-flight deploys

.github/workflows/ci.yml

@@ -17,6 +17,10 @@ on:
   push:
     branches: [main, refactor/main]
 
+permissions:
+  contents: read
+  security-events: write
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/cluster-daily.yml

@@ -14,6 +14,9 @@ on:
   # Allow manual triggering from the Actions tab when you want to force a run.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   recompute:
     runs-on: ubuntu-latest

.github/workflows/relevance-daily.yml

@@ -16,6 +16,9 @@ on:
     - cron: "0 7 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   notify:
     runs-on: ubuntu-latest

src/02-server/Middleware/ExceptionHandlingMiddleware.cs

@@ -123,12 +123,16 @@ private async Task HandleExceptionAsync(HttpContext context, Exception exception
         // make it easy to filter and alert on specific error patterns
         // once we add Serilog + Application Insights in Phase 4.8.
         // ---------------------------------------------------------------
+        var safePath = context.Request.Path.Value?
+            .Replace("\r", string.Empty)
+            .Replace("\n", string.Empty) ?? string.Empty;
+
         _logger.LogError(
             exception,
             "Unhandled exception — Code: {ErrorCode}, Status: {StatusCode}, Path: {Path}",
             errorCode,
             (int)statusCode,
-            context.Request.Path);
+            safePath);
 
         // ---------------------------------------------------------------
         // Write the response.