Restrict GITHUB_TOKEN scope in workflows (least privilege)

[r--w]

Summary

• Adds explicit permissions: contents: read at the workflow root of publish.yml and tests.yml.
• Resolves CodeQL alerts actions/missing-workflow-permissions (Fixes in prep for PYPI #1, fixes & migration from /pools #2) flagged in org-wide GitHub Advanced Security scan.

Why

Without an explicit permissions: block, the default GITHUB_TOKEN inherits whatever the repo/org-wide default is - historically read-write on older orgs. Both jobs only need to read the repo:

• tests.yml: checks out code and runs pytest
• publish.yml: checks out code and uploads to PyPI via TWINE_USERNAME / TWINE_PASSWORD secrets (independent of GITHUB_TOKEN)

Test plan

• Confirm the Tests workflow still runs on this PR (it should - read-only is sufficient for checkout + pytest).
• After merge, cut a release and verify publish.yml still publishes to PyPI (TWINE secrets are unaffected by GITHUB_TOKEN scope).
• Verify the two CodeQL alerts auto-close.