Potential fix for https://github.com/cyberdotgent/CSV-Explorer/security/code-scanning/3

In general, the problem is fixed by explicitly declaring minimal GITHUB_TOKEN permissions in the workflow, instead of relying on repository/organization defaults. For pure CI/build jobs that only need to read the repository, contents: read is usually sufficient. Jobs that need to publish releases or otherwise write to the repo can get limited write scopes as already done for release-windows.

The best way to fix this file without changing behavior is to add a root‑level permissions block that applies to all jobs by default, setting it to the least privilege needed for the majority of jobs (contents: read). The existing permissions block in the release-windows job already requests contents: write and will override the root default for that one job, so we should leave it intact. Concretely, we’ll insert:

permissions:
  contents: read

near the top of .github/workflows/ci.yml, after the on: block (or before env:), at the same indentation level as name, on, env, and jobs. No imports or extra methods are needed, only this YAML addition.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.