zizmor: remaining lower-severity GitHub Actions findings

[blarghmatey]

Background

PR #24 added a zizmor security-scanning workflow (.github/workflows/actions-static-analysis.yml) that lints .github/workflows/** on every push/PR touching workflow files. The check is gated to min-severity: high / min-confidence: medium so it only fails CI on the most severe findings.

Running zizmor without any severity filter against the current workflows surfaces one additional, lower-severity finding that predates PR #24 and is not enforced by the new CI check:

GH_TOKEN=$(gh auth token) uvx zizmor --no-progress .github/workflows/

Findings

excessive-permissions (medium confidence) — .github/workflows/ci.yml:20

The test job has no permissions: block, so it runs with the default (broad) GITHUB_TOKEN permissions rather than an explicit least-privilege set.

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/ci.yml:20:3
   |
20 | /   test:
21 | |     runs-on: ubuntu-latest
22 | |     steps:
...  |
34 | |       - run: uv run pytest --cov=ol_analytics_api --cov-report=term-missing
   | |____________________________________________________________________________this job
   |                                                                              default permissions used due to no permissions: block
   |
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

Fix: add an explicit permissions: block to the test job (or workflow-level) scoped to what the job actually needs (likely just contents: read).

Notes

• This is a pre-existing condition in ci.yml, newly surfaced by the zizmor scanner added in PR Harden supply-chain security for CI and dependencies #24 — not a regression introduced by that PR.
• It's intentionally out of scope for PR Harden supply-chain security for CI and dependencies #24's CI check, which only gates on high-severity/medium-confidence-or-above findings.