ci(codeql): set empty workflow permissions and document the job's

zizmor reports two findings in `codeql.yml`:

- `excessive-permissions`: the workflow has no top-level
  `permissions:`, so any job without its own would get the
  repository's default `GITHUB_TOKEN` permissions.
- `undocumented-permissions`: the `analyze` job's
  `security-events: write` has no comment saying why it is needed.

The only job already sets its own permissions, so the first finding
describes no current excess. But a job added later without its own
`permissions:` would silently get the defaults, and every other
workflow here sets top-level permissions.

Add `permissions: {}` at the top level, noting that the `analyze` job
expands it, and explain that `security-events: write` is needed to
upload SARIF results for the Security tab. The job's effective
permissions do not change. The wording matches gitoxide's
`codeql.yml`, which made the same changes for the same zizmor
findings. Unlike there, no comment is added about permissions that
the job does not need; those were removed here earlier as
unnecessary.

The workflow is disabled while CodeQL default setup is enabled, but it
is still tracked and may be enabled again.

zizmor 1.31.1 at the `pedantic` level no longer reports either
finding. `actionlint` reports no problems.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: EliahKagan

.github/workflows/codeql.yml

@@ -18,6 +18,8 @@ on:
   schedule:
     - cron: '27 10 * * 3'
 
+permissions: {}  # Expanded in the `analyze` job.
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -28,7 +30,7 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      security-events: write
+      security-events: write  # Required for uploading SARIF to view in the Security tab.
 
     strategy:
       fail-fast: false