ci(codeapi): set minimum workflow token permissions to contents: read (#2102)

Source: ClickHouse/ai@f0093f4b52a8da08092d4da4a7157b7ca30cd8ec

Author: github-actions[bot]

.github/workflows/ci.yml

@@ -14,6 +14,9 @@ on:
     branches: [main, 'sync/**']
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref_name }}
   cancel-in-progress: true