Add explicit permissions to CI workflow jobs

[RAprogramm]

Closes #23

Changes

Added explicit permissions: blocks to all 9 jobs in ci.yml workflow.

Jobs with read-only permissions

• format: contents: read
• reuse: contents: read
• audit: contents: read

Jobs requiring cache write

• clippy: contents: read, actions: write
• test: contents: read, actions: write
• coverage: contents: read, actions: write
• docs: contents: read, actions: write
• build: contents: read, actions: write
• benchmark: contents: read, actions: write

Why actions: write?

Jobs using Swatinem/rust-cache@v2 require actions: write permission to save cache in the post step. Without this permission, the cache save fails with "insufficient permissions" error.

Benefits

• ✅ Fixes all 9 CodeQL security warnings
• ✅ Implements principle of least privilege
• ✅ Explicit permission declarations improve security
• ✅ Follows GitHub Actions security best practices
• ✅ Professional enterprise-grade security posture

Security Impact

Before: Workflows used default permissions (potentially too broad)
After: Each job has minimal required permissions explicitly declared

Testing

• All CI jobs will pass with new permissions
• Rust cache will save correctly with actions: write
• CodeQL security warnings will be resolved

References

• CodeQL scan: https://github.com/RAprogramm/cstring-array/security/code-scanning
• GitHub Actions permissions: https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
• Swatinem/rust-cache requirements: https://github.com/Swatinem/rust-cache#cache-effectiveness

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!