This PR fixes the CodeQL workflow permissions to follow GitHub security best practices by moving the security-events: write permission from the workflow level to the job level.

Changes Made

• Moved security-events: write permission from workflow-level to job-level in .github/workflows/codeql-analysis.yml
• Kept contents: read at workflow level (needed for checkout action)

Before

permissions:
  security-events: write
  contents: read

jobs:
  CodeQL-Build:
    runs-on: ubuntu-latest

After

permissions:
  contents: read

jobs:
  CodeQL-Build:
    runs-on: ubuntu-latest
    permissions:
      security-events: write

Why This Change?

This change follows the principle of least privilege by scoping the security-events: write permission only to the specific job that needs it (the one running github/codeql-action/analyze), rather than making it available to the entire workflow.

This pattern is already correctly implemented in the ossf-scorecard.yml workflow, and now both workflows that perform code scanning follow the same secure configuration.

Fixes #32.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.