[NeonTechno]

Summary

• Set least-privilege workflow default permissions (contents: read).
• Grant the Security Scan job security-events: write for SARIF uploads.
• Upgrade github/codeql-action/upload-sarif from deprecated @v2 to @v3.
• Skip SARIF publication for fork-originated pull requests, where write permissions are not available, and preserve the SARIF file as an artifact for review.

Evidence

The failing run was https://github.com/Decentralized-Rights-Protocol/Dr-Blockchain/actions/runs/39149801930. Its Trivy step succeeded; the upload step failed with the deprecated v2 action message and Resource not accessible by integration.

This PR changes only .github/workflows/ci.yml. Please keep unmerged until the new Security Scan run verifies the behavior.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}