Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[secondfry]

Potential fix for https://github.com/secondfry/shortcircuit/security/code-scanning/1

In general, the fix is to add an explicit permissions: block either at the workflow root (applies to all jobs without their own permissions) or within the specific job. The block should grant only the least privileges necessary, which in this case is read access to repository contents (contents: read). No steps in the shown job need write access to the repo, nor access to issues, pull requests, or other resources.

The single best fix, without changing existing functionality, is to add a minimal permissions block at the top level of the workflow (right after name: CI and before on:). This will apply to all jobs (currently just build) and clearly communicates that the workflow only needs read permissions on contents. Concretely, in .github/workflows/main.yml, insert:

permissions:
  contents: read

between lines 1 and 3 in the snippet provided. No additional imports or methods are needed, as this is YAML configuration only.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.