Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[pcarleton]

Potential fix for https://github.com/modelcontextprotocol/conformance/security/code-scanning/1

General fix:
Add an explicit permissions block to the workflow to restrict the GITHUB_TOKEN's access, using the narrowest set of permissions required.

Detailed fix:
Since this workflow only checks out code and runs node tasks (no publishing, no deployment, no pull-request modification), the minimal required permission is contents: read. This should be set near the top of the workflow, ideally at the root level, so it applies to all jobs.

Where/how to change:

• Add the following block directly below the workflow's on: section (after line 5 or line 6):

permissions:
  contents: read

What's needed:

• Just add a permissions key to the workflow; no imports or external changes are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.