fix(ci): add permissions block to secret-scan job

Address github-advanced-security bot review comment by setting explicit
minimal permissions (contents: read) for the GITHUB_TOKEN.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/test-linting.yml

@@ -78,6 +78,8 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
 
     steps:
     - uses: actions/checkout@v4