Update action token permissions

[bingenito]

No description provided.

[Copilot]

PR Overview

This PR updates the permissions for action tokens in GitHub workflows to enforce minimal access.

• In deploy-site.yml, the "contents" permission is set to read, ensuring limited token scope.
• In dependency-submission.yml, a workflow-level "contents: read" permission is newly added alongside a job-specific override setting "contents: write".

Reviewed Changes

File	Description
.github/workflows/deploy-site.yml	Updated the deploy site's permissions by adding "contents: read" under permissions.
.github/workflows/dependency-submission.yml	Introduced a workflow-level "contents: read" and added job-level permissions, which now differ in the "contents" setting.

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

.github/workflows/dependency-submission.yml:9

• There is a potential inconsistency: the workflow-level permissions set 'contents' to read, while the dependency-submission job overrides it with 'contents: write'. Please confirm if this discrepancy is intentional.

  contents: read

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.87%. Comparing base (6f54cdb) to head (77ce918).
Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #959      +/-   ##
==========================================
- Coverage   67.88%   67.87%   -0.02%     
==========================================
  Files         308      308              
  Lines        9131     9131              
  Branches      903     1053     +150     
==========================================
- Hits         6199     6198       -1     
+ Misses       2702     2701       -1     
- Partials      230      232       +2     

see 2 files with indirect coverage changes