Fix CodeQL workflow permissions: add security-events: write to Codeql-build job

[Copilot]

This PR fixes a security permissions issue in the CodeQL workflow configuration. The Codeql-build job in .github/workflows/webserver.yml was using github/codeql-action/analyze@v2 without the required security-events: write permission at the job level.

Problem

The workflow had permissions defined only at the root level (contents: read), which is insufficient for CodeQL analysis actions that need to upload security events to GitHub's code scanning dashboard.

Solution

Added job-level permissions to the Codeql-build job:

Codeql-build:
  name: static-analysis
  runs-on: ubuntu-20.04
  permissions:
    security-events: write
  steps:
    # ... existing steps

This ensures that the CodeQL analyze action has the necessary permissions to function correctly while following GitHub's security best practices of defining permissions at the job level rather than the workflow level.

Verification

• ✅ YAML syntax validated
• ✅ Only workflow using github/codeql-action/analyze identified and fixed
• ✅ ossf-scorecard.yml already has correct job-level permissions for github/codeql-action/upload-sarif

Fixes #21.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.