Potential fix for code scanning alert no. 8: Workflow does not contain permissions

[nstarman]

Potential fix for https://github.com/GalacticDynamics/galactic_dynamics_interoperability/security/code-scanning/8

Add an explicit permissions block so the dist job does not inherit potentially broad defaults.
Best minimal fix without changing functionality: add permissions: { contents: read } to the dist job in .github/workflows/cd.yml.

Why this is best here:

• It directly addresses the flagged job.
• dist needs repository read access for actions/checkout, and no write scopes are indicated.
• It does not alter publish job behavior, which already has explicit id-token: write.

Change location:

• File: .github/workflows/cd.yml
• Region: inside jobs.dist, between name and runs-on (or equivalent position within that job block).

No imports, methods, or dependencies are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.02%. Comparing base (a21fe43) to head (d14216d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #28   +/-   ##
=======================================
  Coverage   94.02%   94.02%           
=======================================
  Files           7        7           
  Lines          67       67           
=======================================
  Hits           63       63           
  Misses          4        4           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.