ci(codeql): explicitly grant runner token permissions

This allows us to make our runner token only have read-only permissions
by default

Signed-off-by: Seth Flynn <getchoo@tuta.io>

.github/workflows/codeql.yml

@@ -58,10 +58,16 @@ on:
       - ".github/actions/setup-dependencies/**"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   CodeQL:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      security-events: write
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6