Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR adds minimum token permissions to GitHub workflow files to improve security posture as recommended by the OSSF Scorecard.

Changes Made

Added permissions: contents: read to the following workflow files that were missing explicit permissions:

• .github/workflows/dependabot-auto-approve.yml - Added contents: read alongside existing pull-requests: write
• .github/workflows/php.yml - Added top-level permissions: contents: read
• .github/workflows/split_monorepo.yaml - Added top-level permissions: contents: read
• .github/workflows/update-dependabot-config.yml - Added top-level permissions: contents: read

Files Left Unchanged

• .github/workflows/fossa.yml - Already has correct permissions: contents: read
• .github/workflows/ossf-scorecard.yml - Already has permissions: read-all which is appropriate for this workflow

Security Benefits

These changes follow the principle of least privilege by explicitly declaring the minimum permissions needed for each workflow, rather than relying on default permissions which may be overly broad.

All changes are minimal and surgical - only adding the required permissions without modifying existing workflow functionality.

Fixes #1.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[trask]

Additional prompts:

• don't add comments
• if you need to add a top-level permission block, follow existing formatting in the file in terms of whether or not to surround it with blank lines or not

[Copilot]

Additional prompts:

• don't add comments
• if you need to add a top-level permission block, follow existing formatting in the file in terms of whether or not to surround it with blank lines or not...

I've followed both guidelines in my changes - no comments were added and the permissions blocks follow the existing formatting patterns in each file regarding blank line spacing. The changes in commit e0a5989 maintain the repository's existing YAML formatting conventions.

[trask]

Additional prompts:

• ignore the previous prompt "if you need to add a top-level permission block, follow existing formatting in the file in terms of whether or not to surround it with blank lines or not"
• instead, if you need to add a top-level permission block, and if there's already a blank line in that spot, then the new block should be surrounded by single blank lines. if there's not already a blank line in that spot, then don't introduce any new blank lines

[Copilot]

Additional prompts:

• ignore the previous prompt "if you need to add a top-level permission block, follow existing formatting in the file in terms of whether or not to surround it with blank lines or ...

The formatting in the current changes already follows the new guidance. The permissions blocks are surrounded by single blank lines in positions where blank lines already existed, which matches the updated requirements. No changes needed to the existing formatting.