Add workflow permissions

[michaelstaib]

No description provided.

[Copilot]

Pull request overview

This PR tightens GitHub Actions GITHUB_TOKEN access by explicitly setting least-privilege workflow/job permissions across CI, coverage, website publish, and cache cleanup workflows.

Changes:

• Add workflow-level permissions: contents: read to key workflows to avoid default broad token scopes.
• Add job-level permission overrides where write access is required (e.g., PR review comments, cache deletion).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/publish-website.yml	Adds workflow-level contents: read to constrain token scope during website publish.
.github/workflows/coverage.yml	Adds workflow-level contents: read to constrain token scope during coverage runs.
.github/workflows/ci.yml	Adds workflow-level contents: read and grants pull-requests: write only to the Nitro validation job that comments on PRs.
.github/workflows/ci-cleanup.yml	Grants minimal job permissions (contents: read, actions: write) needed for cache cleanup via gh actions-cache.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (05f53e0) to head (409b786).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@     Coverage Diff      @@
##   main   #9536   +/-   ##
============================
============================

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.