Restrict build workflow GITHUB_TOKEN permissions

[Copilot]

This change addresses the CodeQL workflow-permissions finding on the build pipeline. The build workflow did not declare explicit token scopes, so it inherited broader default GITHUB_TOKEN permissions than required.

• What changed

  • Added an explicit top-level permissions block to .github/workflows/build.yml
  • Scoped the workflow token to the only access needed by this job: repository contents read access

• Why this matters

  • Reduces ambient permissions for the build workflow
  • Aligns the workflow with GitHub Actions least-privilege guidance
  • Resolves the code scanning alert without changing job behavior

• Resulting workflow shape

  permissions:
    contents: read