Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[aegilops]

Potential fix for https://github.com/advanced-security/secret-scanning-custom-patterns/security/code-scanning/3

To fix the problem, an explicit permissions block should be added at the workflow or job level to limit the privileges granted to the default GITHUB_TOKEN. The minimal recommended setting is contents: read, which allows the workflow steps to read repository contents but not modify them. Since the workflow uses a GitHub App token to perform actions like PR comments, additional permissions (like pull-requests: write) for the default GITHUB_TOKEN may not be needed unless the workflow fails with permission errors. The edit should be made at the root of the workflow YAML file (right after name: Markdown Validation) or under the individual job if some jobs require different permissions. This involves adding:

permissions:
  contents: read

If you discover later that the workflow requires additional permissions for the default token, you can incrementally allow them. For now, just add this block beneath the name line.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.