Potential fix for code scanning alert no. 5: Workflow does not contain permissions

[jackby03]

Potential fix for https://github.com/jackby03/wovensnake/security/code-scanning/5

In general, the fix is to add an explicit permissions: block that limits the GITHUB_TOKEN to the minimal scopes needed. Since this workflow only checks out code, installs toolchains, uses caches, and runs tests, it only needs read access to repository contents. The recommended approach is to add a single root-level permissions: block so that it applies to all jobs, unless a job needs different permissions in the future.

The best single change without altering existing functionality is to insert a top-level permissions: section after the on: block (before env:) in .github/workflows/dev.yml:

permissions:
  contents: read

This will apply to both quality and test jobs. No steps currently require write access (no pushes, issue or PR updates, releases, etc.), so restricting contents to read is sufficient and safe. No imports or additional methods are needed; this is purely a YAML configuration change within the workflow file.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.