Potential fix for code scanning alert no. 468: Workflow does not contain permissions

[bumahkib7]

Potential fix for https://github.com/bumahkib7/rust-monorepo-analyzer/security/code-scanning/468

In general, the fix is to add an explicit permissions block that grants only the minimal required scopes for the GITHUB_TOKEN. For a pure CI workflow that only checks out code and runs build/lint/test steps, contents: read is typically sufficient. Since none of the jobs in this workflow create releases, push commits, comment on PRs, or otherwise modify GitHub resources, a single top-level permissions: block with contents: read is the safest and simplest fix.

The best fix here is to add a workflow-level permissions: section near the top of .github/workflows/ci.yml (for example, after the on: section) so it applies to all jobs (fmt, clippy, and test) without needing to duplicate configuration. Specifically, insert:

permissions:
  contents: read

This restricts the automatically provided GITHUB_TOKEN to read-only access to repository contents, which is enough for actions/checkout@v4 and the caching action, and it documents the expectations clearly. No changes are needed inside the individual jobs or steps.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.