Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[stalina]

Potential fix for https://github.com/stalina/locapilot/security/code-scanning/1

In general, the fix is to explicitly declare a permissions block that scopes the GITHUB_TOKEN to the least privileges needed. Since none of the jobs modify repository contents, issues, or pull requests, we can safely limit contents to read. Declaring this once at the top level of the workflow applies to all jobs that don’t override permissions, which avoids duplication and does not change any functional behavior of the existing steps.

The best single change is to add a root-level permissions section right after the name: CI (or before jobs:) in .github/workflows/ci.yml:

permissions:
  contents: read

No other scopes appear necessary: the jobs use actions/checkout, actions/setup-node, run npm commands, upload artifacts via actions/upload-artifact, and use codecov/codecov-action. All of these work with contents: read and do not require write access to the repo. We do not need to modify individual jobs, steps, or introduce any new dependencies or imports; the change is purely declarative in the workflow YAML.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.