ci(test): set permissions in test workflow

[joshmgross]

• https://github.com/actions/create-github-app-token/security/code-scanning/13
• https://github.com/actions/create-github-app-token/security/code-scanning/14

This defines permissions on the test.yml workflow to align with our Actions security best-practices and ensure workflows only have the minimum required permissions.

[Copilot]

Pull Request Overview

This PR adds a permissions block to the test.yml workflow to enforce least-privilege access for the GitHub token.

• Defines contents: read to restrict repository content access.
• Ensures the workflow aligns with security best practices by explicitly setting token permissions.

[gr2m]

I think that should work 👍🏼 We are accessing repository variables and secrets here but I don't think we need an extra permission for that, it's outside what the GITHUB_TOKEN secret is used for