Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[aamoghS]

Potential fix for https://github.com/DataScience-GT/query/security/code-scanning/1

In general, fix this by explicitly declaring minimal GITHUB_TOKEN permissions for the workflow or for each job. For a pure build job that only checks out code and runs local commands, contents: read is usually sufficient. Add a permissions block either at the root level (applies to all jobs) or under the build job (applies only to that job).

The best minimal change here is to add a job-level permissions block under jobs.build, just above runs-on. This avoids affecting any other jobs that might be added later and keeps the change clearly scoped. No other functionality changes are required, and no imports or dependencies are involved because this is a YAML configuration file.

Concretely, in .github/workflows/pnpm-build.yml, modify the build job definition so that:

  build:
+   permissions:
+     contents: read
    runs-on: ubuntu-latest

This explicitly restricts the GITHUB_TOKEN for this job to read-only access to repository contents.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.