Ensure correct CodeQL workflow permissions

[Copilot]

This PR adds the required security-events: write permission at the job level for the CodeQL workflow that runs github/codeql-action/analyze.

Changes Made

• Added permissions: security-events: write to the CodeQL-Build job in .github/workflows/codeql-analysis.yml
• The permission is correctly defined at the job level (not root level) as per GitHub Actions security best practices

Background

GitHub Actions workflows that use github/codeql-action/analyze require the security-events: write permission to upload code scanning results. This permission should be defined at the job level rather than the workflow root level to follow the principle of least privilege.

Verification

• ✅ YAML syntax validated
• ✅ Only one workflow uses github/codeql-action/analyze
• ✅ Permission follows the same pattern as other security-related workflows in the repository
• ✅ Minimal change with no impact on existing functionality

Fixes #18.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.