Potential fix for https://github.com/teremuhamblin/ExAPI/security/code-scanning/1

Add an explicit permissions block in .github/workflows/test.yml so the workflow does not inherit potentially over-privileged defaults.

Best fix (without changing functionality): set workflow-level permissions to the minimum needed by all jobs in this file. For this workflow, contents: read is the correct baseline and sufficient for actions/checkout and test/build steps. No additional permissions are required for actions/upload-artifact in this workflow context.

Change location:

• File: .github/workflows/test.yml
• Insert directly after the on: trigger block and before jobs::

  permissions:
    contents: read

No imports, methods, or external definitions are needed (YAML config only).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.