Potential fix for code scanning alert no. 10: Workflow does not contain permissions

[t3chguy]

Potential fix for https://github.com/element-hq/element-modules/security/code-scanning/10

The optimal fix is to restrict the GITHUB_TOKEN permissions as early as possible. This can be done either at the root of the workflow (affecting all jobs) or directly in the build-py job. Since there's only one job shown, adding at the job level is satisfactory. The minimal starting permissions are contents: read. However, given the workflow pushes Docker images to GitHub Container Registry (ghcr.io), it also needs packages: write permission (otherwise the Docker push step will fail). Therefore, the permissions block should be added to the build-py job with contents: read and packages: write set.

To implement:

• In file .github/workflows/synapse-module.yml, identify the start of the build-py job and add a permissions: block configuring least-privilege permissions required, immediately after name: and before runs-on:.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.