Give ci.yaml a permissions block

The workflow inherited the repository's default token permissions. None
of its jobs needs more than to read the repository, so say so, as the
other workflows already do.

Author: lkiesow

.github/workflows/ci.yaml

@@ -8,6 +8,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest