Add a permissions block to ci.yml so the default token can drop to read (#605)

* Add a permissions block to ci.yml so the default token can drop to read

The Netlify preview step is the one consumer of the default token's
write access here; contents:read + pull-requests:write is the same
block lecture-jax/ci.yml already carries. The other workflows either
have blocks or write nothing with GITHUB_TOKEN.

Part of QuantEcon/meta#347 item 4.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Grant actions: read for the cache artifact download

Public-repo API leniency is what lets dawidd6/action-download-artifact
work without the scope today; the grant matches the documented
requirement and the comment publish.yml already carries.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: mmcky

.github/workflows/ci.yml

@@ -3,6 +3,10 @@ on: [pull_request]
 jobs:
   preview:
     runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false"
+    permissions:
+      contents: read
+      actions: read         # dawidd6/action-download-artifact reads the cache.yml build artifact
+      pull-requests: write
     steps:
       - uses: actions/checkout@v7
         with: