Add security-events write permission to CodeQL workflow job

[Copilot]

The CodeQL Analysis workflow was missing the required security-events: write permission needed for the github/codeql-action/analyze action to upload security findings to GitHub's security dashboard.

This change adds the permission at the job level (rather than root level) following security best practices:

jobs:
  CodeQL-Build:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      # ... existing steps

The permission is scoped specifically to the job that needs it, ensuring minimal privilege escalation while enabling proper CodeQL analysis functionality.

Fixes #14.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.