Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[thpierce]

Potential fix for https://github.com/aws/aws-xray-sdk-node/security/code-scanning/2

To fix this problem, the workflow must explicitly specify a permissions block, either at the workflow root level (affecting all jobs by default), or within individual jobs. The workflow uses actions/checkout, reads contents, and uploads coverage to Codecov, but does not create or write issues or pull requests. Therefore, the minimal required permission is contents: read. To futureproof the workflow, if other steps require additional permissions, you can grant them specifically. In this case, adding the line:

permissions:
  contents: read

directly after the name field is the best and simplest solution. This ensures the workflow jobs have only read access to repository contents, lowering risk. There is no need to alter any other portions of the workflow, or introduce any new actions, methods, or imports.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.31%. Comparing base (0963c1a) to head (dbc0bde).
⚠️ Report is 18 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #728   +/-   ##
=======================================
  Coverage   84.31%   84.31%           
=======================================
  Files          36       36           
  Lines        1817     1817           
=======================================
  Hits         1532     1532           
  Misses        285      285           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.