Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[ismailtsdln]

Potential fix for https://github.com/malware-insight/sandsight/security/code-scanning/1

In general, to fix this issue you should explicitly declare a permissions: block either at the top level of the workflow (to apply to all jobs) or within the specific job that needs restricted permissions. Set the minimal scopes required, typically starting with contents: read when the workflow only needs to read the repository contents and does not need to write to anything.

For this workflow, the simplest and safest fix without altering existing functionality is to add a permissions: block under the name: key at the root of the file, so it applies to all jobs. The job build only checks out code, sets up Python, installs dependencies, lints, and runs tests; these actions require only read access to repository contents. Therefore, we should add:

permissions:
  contents: read

right after the name: SandSight CI line. No other code changes or imports are necessary, and no job steps need to be modified. The rest of the workflow remains the same.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.