Add explicit permissions to GitHub Actions workflows

[srprash]

Summary

This PR adds explicit permission declarations to two GitHub Actions workflows to follow security best practices and the principle of least privilege.

Changes

1. .github/workflows/codeql-analysis.yml

• Added security-events: write permission
• This permission is required for CodeQL to publish security scan results to GitHub's security dashboard

2. .github/workflows/stale-bot.yml

• Added issues: write permission
• Added pull-requests: write permission
• These permissions make explicit what the workflow needs to mark and close stale issues/PRs

Why these changes?

1. Security best practice: Explicitly declaring permissions makes it clear what access each workflow requires
2. Principle of least privilege: Instead of relying on default GitHub token permissions, we declare only what's needed
3. Auditability: Makes it easier to review and audit workflow permissions across the repository
4. Consistency: Aligns with other workflows in the repository that already declare explicit permissions

Testing

• The changes are declarative and don't modify workflow logic
• CodeQL workflow will continue to function with the added permission
• Stale bot workflow will continue to function with the added permissions