ci: trim permissions for codeql-analysis action

[HonkingGoose]

Changes:

• Trim permissions for codeql-analysis.yml

Context:

I think we can tighten down our permissions for the CodeQL action as well.
There's no official documentation in their README yet, but I did find this issue: github/codeql-action#464

Please read the linked issue before reviewing my PR, maybe I'm missing something important from that discussion!

In that issue a contributor to the project says:

As far as I can tell, if you are using the default workflow, you should only need the following permissions:

    permissions:
      contents: read
      security-events: write
      pull-requests: read

Is your workflow doing anything special?

I figured, we can try these permissions.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please tick one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[viceice]

I'm not sure if we really need this, as this are all primary actions 🤔

[HonkingGoose]

I'm not sure if we really need this, as this are all primary actions 🤔

What do you think @rarkins?

[rarkins]

It's still best practice, but hopefully never needed

[HonkingGoose]

I'd say we're ready to merge and see what happens, I think this is OK, but you can never be sure until you actually run it...

---

If the action breaks somehow after the merge, we can try out this suggestion from a collaborator:

It's possible that you will also need the: actions: read permission. Some code flows will make requests to introspect the current workflow and this permission is needed. So, if you get any more failures, try adding that permission as well.

github/codeql-action#464 (comment)

[renovate-release]

🎉 This PR is included in version 25.56.1 🎉

The release is available on:

• GitHub release
• 25.56.1

Your semantic-release bot 📦🚀