Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[skymeyer]

Potential fix for https://github.com/skymeyer/ots/security/code-scanning/1

• In general, the fix is to add an explicit permissions block that grants only the minimal required scopes for the GITHUB_TOKEN. For a pure CI job that only checks out code and runs tests, contents: read is sufficient.
• The best targeted fix here is to add permissions: contents: read at the job level under go:. This documents the intended minimal access and ensures the job will not gain unintended write privileges even if repository/organization defaults are broad or change later.
• Concretely, edit .github/workflows/tests.yaml and insert a permissions: section under the go: job (after runs-on: ubuntu-latest), properly indented:
  • Line 11 currently is runs-on: ubuntu-latest. After that line, add:

    permissions:
      contents: read

• No new imports, methods, or definitions are required; this is purely a YAML configuration change to the workflow.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.