Add least-privilege permissions to GitHub Actions workflows

[julerobb1]

Fixes CodeQL actions/missing-workflow-permissions alerts #1–#9. Every flagged job/workflow now has an explicit permissions: block so GITHUB_TOKEN is least-privilege instead of the default write-all.

No build steps, triggers, or secrets were changed. release.yml was already fixed on main (alert #11 / Copilot Autofix). .github/workflows/dependabot.yml is a Dependabot config, not an Actions workflow, so it was left alone.

Permissions granted (and why)

Workflow-level default is contents: read everywhere (checkout / restore / build / test / upload-artifact, which uses the Actions runtime token rather than write on GITHUB_TOKEN). Job-level overrides replace that default only where a job needs more:

Workflow	CodeQL alerts	Permissions	Why
ci.yml	#1	contents: read	Checkout + dotnet restore/build/test only
codeql-analysis.yml	#2	Workflow: contents: read. Job analyze: actions: read, contents: read, security-events: write	Official CodeQL v2 set: checkout, workflow introspection, SARIF upload. No packages: read (no private query packs)
build.yml	#3	Workflow: contents: read. Job build: contents: write	Same job also runs actions/create-release@v1 on tags
dotnet-desktop-build.yml	#4, #6	contents: read	Both Debug and Release jobs only checkout and build
dev-build.yml	#5	contents: read	Checkout + build + test
nightly-build.yml	#7	contents: read	Checkout, build/test, local publish, actions/upload-artifact@v3
prod-build.yml	#8	contents: read	Same as nightly (artifact upload only; no GitHub Release)
release-drafter.yml	#9	Workflow: contents: read. Job update_release_draft: contents: write, pull-requests: read	release-drafter/release-drafter@v5 drafts a release and reads merged PR metadata. No pull-requests: write (autolabeler is not used)
release.yml	(already on main)	Workflow: contents: read. Job build-and-release: contents: write	Unchanged; create-release + upload-release-asset

Notes

• Job-level permissions fully replace the workflow-level set (they do not merge), so CodeQL’s analyze job restates contents: read alongside its write grant.
• packages: write and id-token: write are not granted anywhere; nothing publishes packages or uses OIDC.