CI: run on push to main and set least-privilege GITHUB_TOKEN permissions

Add a push trigger on main so the full CI matrix (lint, unit, integration)
re-runs on merge, matching dropbox-sdk-dotnet; previously ci.yml only ran on
pull_request, so main could break undetected.

Also add a top-level `permissions: contents: read` to both workflows to
satisfy the CodeQL missing-workflow-permissions alert. Jobs that need OIDC
keep their job-level id-token: write override.

Author: AndreyVMarkelov

.github/workflows/ci.yml

@@ -1,7 +1,13 @@
 name: CI
 on:
+  push:
+    branches:
+      - main
   pull_request:
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   CI:
     runs-on: ${{ matrix.os }}

.github/workflows/coverage.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: 0 0 * * *
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   Coverage:
     runs-on: ubuntu-latest