hardening: lock GITHUB_TOKEN to contents: read across all CI jobs

[Keengfk]

Without an explicit permissions: block, every job in ci.yml ran with GitHub's
default token scopes — which include contents: write on push events from the
same repository. None of the six jobs here (formatting, tests, wasm-size check,
proptest, dependency audit, mutation testing) need write access to anything. A
compromised third-party action (Swatinem/rust-cache, dtolnay/rust-toolchain) or
a malicious step in a PR-triggered run would have had unnecessary repository
write privilege available to abuse.

What changed

.github/workflows/ci.yml

Added a top-level permissions: contents: read block immediately after the on:
trigger. The block header explains:

• why contents: read is sufficient for all current jobs
• why GITHUB_STEP_SUMMARY writes (used by the wasm-size job) are local runner
  file writes and don't require a GitHub API permission
• that for push events from the same repo, this overrides the otherwise-default
  contents: write; for fork pull_request events GitHub already enforces
  read-only, so this covers both trigger types consistently
• how to add a narrowly-scoped job-level permissions: override for any future
  job that genuinely needs more (e.g. pull-requests: write to post a PR comment)
  — without widening the workflow-level block

Each of the six jobs also got an inline # Needs: comment documenting its
specific requirements so the rationale is visible at the job level, not just at
the top of the file.

CONTRIBUTING.md

Added a "GITHUB_TOKEN permission model" section to the Maintainer Guide with:

• a per-job audit table confirming each job's minimum required scope
• the rationale for the explicit block (default scopes, both trigger types)
• a concrete example of how to add a job-level override for a future job that
  needs elevated scope

No logic changed

All six CI jobs run identically with the narrowed token. None of them call any
GitHub API beyond checkout (actions/checkout uses contents: read to clone the
repository). The change is purely additive — one YAML key and documentation.

Audit summary

┌───────────┬──────────────────────────────────────────────┬────────────────┐
│ Job │ Operations │ Scope needed │
├───────────┼──────────────────────────────────────────────┼────────────────┤
│ fmt │ checkout, cargo fmt --check │ contents: read │
├───────────┼──────────────────────────────────────────────┼────────────────┤
│ contract │ checkout, clippy, test │ contents: read │
├───────────┼──────────────────────────────────────────────┼────────────────┤
│ wasm-size │ checkout, build, write to │ contents: read │
│ │ $GITHUB_STEP_SUMMARY (local file) │ │
├───────────┼──────────────────────────────────────────────┼────────────────┤
│ proptest │ checkout, cargo test │ contents: read │
├───────────┼──────────────────────────────────────────────┼────────────────┤
│ audit │ checkout, cargo audit (RustSec over HTTPS) │ contents: read │
├───────────┼──────────────────────────────────────────────┼────────────────┤
│ mutants │ checkout, cargo mutants (runner-local temp │ contents: read │
│ │ copy) │ │
└───────────┴──────────────────────────────────────────────┴────────────────┘

closes #278

[drips-wave]

@Keengfk Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits