Potential fix for code scanning alert no. 11: Workflow does not contain permissions

[kdinev]

Potential fix for https://github.com/IgniteUI/igniteui-angular/security/code-scanning/11

To fix the issue, we need to add an explicit permissions block at the workflow level (top-level, before jobs:) to restrict the permissions provided to GITHUB_TOKEN to the minimal required for the workflow, typically contents: read. This prevents unintended write access to the repository, adhering to the principle of least privilege. Based on the visible steps, the workflow does not modify the repository or open issues/pull requests, so contents: read is sufficient.

To implement:

• Insert a permissions: block directly after the workflow name: section, and before the on: or jobs: sections in .github/workflows/npm-publish.yml.
• The block should be:

  permissions:
    contents: read

• No other code modifications, imports, or dependency changes are necessary.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.