GitHub Actions workflow pythonpackage.yml lacks permission declarations

[mhucka]

Describe the issue

Code scans report that .github/workflows/pythonpackage.yml lacks top-level permissions declarations.

This check determines whether the project's automated workflows tokens follow the principle of least privilege. This is important because attackers may use a compromised token with write access to, for example, push malicious code into the project.

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

How can the issue be reproduced?

This is easily resolved by adding permission declarations.

[mhucka]

Addressed in PR #418.