Fix for code scanning alert: Workflow does not contain permissions

[ScottBrenner]

In general, this issue is fixed by explicitly defining a permissions block for the workflow or individual jobs to restrict the GITHUB_TOKEN to the minimal scope needed. For read-only CI jobs like tests and linting, contents: read is typically sufficient, since they only need to clone the repo and read files.

The best fix here without changing existing functionality is to add a workflow-level permissions block that applies to both test and lint jobs. Both jobs only check out the repository and run local Go commands; they do not require write access to any GitHub resources. Therefore, we can add:

permissions:
  contents: read

near the top of .github/workflows/checks.yaml, for example immediately after the on: block (or after name:), so that it applies to all jobs. No other code changes or imports are needed, and behavior of the workflow remains the same except that its token is now scoped down.

Concretely: in .github/workflows/checks.yaml, insert a permissions: section between the existing on: block (lines 3–8) and the env: block (line 9), leaving all existing keys and job definitions unchanged.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[ScottBrenner]

Hey @metonym spare a moment to review?