.github: restrict workflow permissions

As suggested by CodeQL scanning.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/workflows/build.yml

@@ -10,6 +10,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, labeled]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true