Potential fix for code scanning alert no. 4: Workflow does not contain permissions

[byo]

Potential fix for https://github.com/cinode/go/security/code-scanning/4

To fix this issue, the images job should have an explicit permissions: block specifying the minimum permissions needed. Reviewing the job's actions:

• It downloads artifacts (read access to contents is sufficient for downloading artifacts generated in the workflow run).
• It does not push, create, or modify repository contents, issues, packages, etc.
• Downloading artifacts only requires contents: read.

Therefore, the minimal, correct fix is to add:

permissions:
  contents: read

just beneath runs-on: ubuntu-latest within the images job (line 92).

No new imports or definitions are needed; just a simple addition of this block.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coveralls]

coverage: 95.808%. remained the same
when pulling 5f9d00c on alert-autofix-4
into 8601866 on master.