set top level permissions to read

Best practice is to set top level to read only in the event additional jobs are added to the file.

This fixes a code scanning alert.

Author: dibenede

.github/workflows/codeql.yml

@@ -11,6 +11,8 @@
 #
 name: "CodeQL"
 
+permissions: read-all
+
 on:
   push:
     branches: [ "main" ]