fix(typescript): address code scanning alerts

[chaliy]

Summary

• Add explicit least-privilege GitHub Actions permissions for CI and OpenAPI sync workflows.
• Replace TypeScript base URL trailing slash regex with bounded string trimming.
• Add coverage for multiple trailing slash normalization.

Test Plan

• just test

• just lint

• just pre-pr

• just pre-push

• Tests pass locally

• Coverage ≥80%

• Linting passes

Checklist

• Follows SDK API consistency guidelines
• Updated relevant specs (if applicable)
• Added/updated tests
• Updated documentation (if applicable)