Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[vladd-bit]

Potential fix for https://github.com/CogStack/ocr-service/security/code-scanning/3

To fix the problem, explicitly restrict the GITHUB_TOKEN permissions used by this workflow to the minimal set required. Since this workflow only checks out code and runs Docker-based smoke tests, it only needs read access to repository contents. It does not appear to need to write to the repo, issues, or pull requests, nor to access other privileged scopes.

The best way to fix this without changing functionality is to add a permissions block at the top (root) level of .github/workflows/docker_smoke.yml, so it applies to all jobs. Right after the on: block (or just after the name), add:

permissions:
  contents: read

No additional imports or methods are needed; this is purely a YAML configuration hardening change. Concretely, in .github/workflows/docker_smoke.yml, insert the permissions section between the on: block (line 3–8) and the jobs: key (line 10). This will ensure the GITHUB_TOKEN only has read access to repository contents for all jobs in this workflow.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.