Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[vladd-bit]

Potential fix for https://github.com/CogStack/ocr-service/security/code-scanning/2

To fix the problem, explicitly restrict the GITHUB_TOKEN permissions for this workflow. Since the job only needs to read repository contents (for actions/checkout), we can safely set contents: read at the workflow root. This will apply to all jobs (there is only one job, build) unless they override it.

Concretely:

• Edit .github/workflows/run_tests.yml.
• Add a permissions: block near the top, alongside name: and on:.
• Set contents: read as a minimal, least-privilege permission. No steps in the current snippet indicate a need for write or other scopes.

Placement:

• Insert the permissions block after the name: tests-ocr-service line and before the on: block, to make it clear that it applies to the whole workflow.

No additional methods, imports, or definitions are needed; this is purely a YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.