Restrict workflow permissions to read-only

[tautschnig]

Description of changes:

Per CodeQL recommendation restrict permissions to read-only rather than the default of read-write.

Resolved issues:

Addresses security recommendations at https://github.com/model-checking/kani-vscode-extension/security/code-scanning.

Testing:

• How is this change tested? CI runs

Checklist

• Each commit message has a non-empty body, explaining why the change was made
• n/a Methods or procedures are documented
• Regression or unit tests are included, or existing tests cover the modified code
• My PR is restricted to a single feature or bugfix

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.