ci: add explicit permissions to semgrep workflow

[ngjaying]

This PR fixes security alert #153 by adding explicit permissions to the semgrep workflow. The fix adds \permissions: contents: read\ to scope the GITHUB_TOKEN following the principle of least privilege.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.91%. Comparing base (f611688) to head (0d93094).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3992      +/-   ##
==========================================
- Coverage   71.95%   71.91%   -0.04%     
==========================================
  Files         457      457              
  Lines       52717    52717              
==========================================
- Hits        37930    37910      -20     
- Misses      11864    11881      +17     
- Partials     2923     2926       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.