Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR implements minimum token permissions for all GitHub workflow files to improve the repository's security posture according to OpenSSF Scorecard recommendations.

Changes Made

Fixed benchmark.yml:

• Before: Root-level permissions with contents: write and deployments: write
• After: Root-level permissions: contents: read with write permissions moved to job level

# Before
permissions:
  contents: write
  deployments: write

# After  
permissions:
  contents: read

jobs:
  store_benchmark:
    permissions:
      contents: write
      deployments: write

Compliance Status

All 13 workflow files now comply with OpenSSF Scorecard token-permissions requirements:

✅ 12 files with permissions: contents: read:

• benchmark.yml (fixed)
• ci.yml, clang-tidy.yaml, cmake_install.yml, codeql-analysis.yml
• cppcheck.yml, dependencies_image.yml, fossa.yml, iwyu.yml
• project_management_comment.yml, project_management_issue_open.yml, stale.yml

✅ 1 file with permissions: read-all:

• ossf-scorecard.yml (acceptable per OpenSSF guidelines)

Security Impact

• Implements principle of least privilege for GitHub Actions tokens
• Root-level permissions now limited to read-only access
• Write permissions only granted at job level where actually needed
• Maintains all existing functionality while improving security posture

Fixes #27.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.