Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[teolemon]

Potential fix for https://github.com/openfoodfacts/openfoodfacts-web/security/code-scanning/3

To fix the problem, we need to set a permissions block at the workflow or job level. Since the update-assets job is the only job, we can add it at the root of the workflow YAML. However, this workflow uses the peter-evans/create-pull-request action, which requires contents: write (to push new commits and branches) and optionally pull-requests: write (to open a PR). At a minimum, we should grant contents: write at the workflow level, and can optionally add pull-requests: write for best compatibility. The change goes at the root, immediately after the name: field and before the on: block.

• Insert a permissions: block with values:

  permissions:
    contents: write

• Optionally, add pull-requests: write if you want to follow the full CodeQL guidance and future-proof for actions that require explicit permission to open pull requests.
• This only requires a direct edit to lines 2–3.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.