Potential fix for code scanning alert no. 9: Workflow does not contain permissions

[simongdavies]

Potential fix for https://github.com/hyperlight-dev/cargo-hyperlight/security/code-scanning/9

Add an explicit permissions block to the validate job in .github/workflows/publish.yml, setting least privilege needed for its steps.

Best minimal fix without changing functionality:

• In job validate (around lines 14–16), add:
  • permissions:
  • contents: read

Why this is best:

• actions/checkout requires repository contents read access.
• The version-check shell script only reads local metadata and does not call GitHub write APIs.
• It addresses the exact CodeQL finding while preserving behavior.

No new imports, methods, or dependencies are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.