Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[ismailtsdln]

Potential fix for https://github.com/offsec-toolkit/domainguardian/security/code-scanning/1

In general, the fix is to explicitly declare a permissions block that scopes down the default GITHUB_TOKEN permissions to only what this workflow needs. Because this workflow is a standard Go CI pipeline (checkout, cache, lint, build, test, upload coverage) and does not appear to modify repository contents, open issues, or PRs, the safest least-privilege setting is contents: read. If later steps need more (e.g., PR comments), additional specific permissions can be added.

The single best way to fix this without changing functionality is to add a top-level permissions section just under the name: line (before on:). This will apply to all jobs in the workflow (currently just ci) that do not override permissions, and it constrains GITHUB_TOKEN to read-only access to repository contents. No imports or other definitions are necessary because this is a YAML configuration change only. Specifically, in .github/workflows/go.yml, insert:

permissions:
  contents: read

immediately after line 1 (name: Go CI / Test / Lint).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.