Use minimal contents:read permissions in CI workflow

Fixes zizmor excessive-permissions finding on ci.yaml; this workflow only needs repository read access.

Author: rosspeili

.github/workflows/ci.yaml

@@ -56,7 +56,8 @@ concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   python-checks: