Set explicit minimum permissions on GitHub Actions workflows

[kmcginnes]

Description

Set explicit minimum permissions (contents: read) at the workflow level on all three GitHub Actions workflows. This follows the principle of least privilege and ensures any future jobs inherit restricted token permissions by default.

• Add top-level permissions: contents: read to unit.yml (was missing entirely)
• Move permissions from job level to workflow level in build_docker.yml
• Move permissions from job level to workflow level in test_build_docker.yml

Validation

• Verify each workflow file has permissions: contents: read at the top level
• Verify no job-level permissions blocks remain
• CI workflows should pass as before since no functional behavior changed

Related Issues

N/A

Check List

• I confirm that my contribution is made under the terms of the Apache 2.0 license.
• I have run pnpm checks to ensure code compiles and meets standards.
• I have run pnpm test to check if all tests are passing.
• I have covered new added functionality with unit tests if necessary.
• I have added an entry in the Changelog.md.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.92%. Comparing base (c5affc5) to head (30cef70).
⚠️ Report is 95 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1573       +/-   ##
===========================================
+ Coverage   47.81%   64.92%   +17.11%     
===========================================
  Files         382      372       -10     
  Lines        8525     8382      -143     
  Branches     3159     3123       -36     
===========================================
+ Hits         4076     5442     +1366     
+ Misses       3070     2085      -985     
+ Partials     1379      855      -524     

Flag	Coverage Δ
unittests	64.92% <ø> (+17.11%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.