Scope down GitHub token permissions (#328)

*Issue #, if available:*

*Description of changes:*

Scope down GitHub token permissions for GHA security best practices.

By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice.

.github/workflows/ci.yml

@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: "0 8 * * *" # Run at 8 AM UTC
 
+
+permissions:
+  contents: read
+
 jobs:
   type-check:
     strategy:

.github/workflows/eval-model.yml

@@ -11,6 +11,10 @@ on:
       - synchronize # When new commits are pushed to the PR
       - labeled     # When a label is added to the PR
 
+
+permissions:
+  contents: read
+
 jobs:
   evaluate-and-print:
     if: contains(github.event.pull_request.labels.*.name, 'run-eval')  # Only run if 'run-eval' label is added