Potential fix for code scanning alert no. 15: Workflow does not contain permissions

[olbrich]

Potential fix for https://github.com/olbrich/ruby-units/security/code-scanning/15

In general, you fix this problem by adding an explicit permissions: block either at the workflow root (so it applies to all jobs by default) or per job, limiting GITHUB_TOKEN to only what is needed (typically contents: read for simple CI). This prevents the workflow from implicitly inheriting broader repository‑level defaults.

The best minimal change here is to add a top‑level permissions: block right under name: Tests that sets contents: read. Both test and yard jobs only check out code, install Ruby, run tests/docs, and invoke a coverage action that uses an external token (QLTY_COVERAGE_TOKEN), so they should not require write access to the repository via GITHUB_TOKEN. Adding a single root‑level block keeps existing functionality intact while addressing the CodeQL warning for all jobs. No new imports or other definitions are needed; this is purely a YAML configuration change within .github/workflows/tests.yml.

Concretely: edit .github/workflows/tests.yml to insert:

permissions:
  contents: read

after line 1 (name: Tests). Indentation must align with other top‑level keys (on:, jobs:). No other lines need to change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.