Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[gitricko]

Potential fix for https://github.com/gitricko/openclaw-webtop/security/code-scanning/1

In general, the problem is fixed by explicitly specifying permissions for the GITHUB_TOKEN either at the workflow root (applies to all jobs without their own permissions) or per job. Here, push-to-ghcr already declares permissions, but build-test (and the workflow root) do not. To avoid changing existing behavior while enforcing least privilege, we should add a root-level permissions block with contents: read, which is sufficient for actions/checkout and does not interfere with push-to-ghcr (its own permissions block will override the root).

Concretely:

• Edit .github/workflows/docker-publish.yml.
• After the name: line and before on:, add:

  permissions:
    contents: read

• Leave the existing permissions block in push-to-ghcr unchanged.

No other methods, imports, or definitions are needed; this is a pure YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.