CI: add security-events write permission

this fixes the failure encountered when trying to upload the SARIF
report during the CI run for the branch. in the PR it worked fine.

the fix was suggested here: github/codeql-action#1720 (comment)

Author: rursprung

.github/workflows/CI.yml

@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  security-events: write # needed to upload SARIF reports on branch builds
+
 on:
   push:
     branches: [ "master" ]