ci: default the test workflows' token to contents: read

[alejoamiras]

pr-checks.yml and main-tests.yml didn't set permissions, so format and the run-tests.yml calls got the repo's default token. That's read-only today, but nothing pinned it - if the setting ever changed, those jobs would get write access while running third-party actions and yarn install.

Adds permissions: contents: read at the workflow level; changes and benchmark keep their own blocks. Closes CodeQL alerts #2, #3 and #4. #38 fixes the same thing on the JS jobs it adds, and the two merge cleanly in either order.

🤖 Generated with Claude Code

[github-actions]

Benchmark Comparison

CPU	Cores	RAM	Arch
AMD EPYC 7763 64-Core Processor	4	16 GiB	x64

Contract: escrow

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	(partial) withdraw	354,645	354,645		3,744	3,744		587,800	587,800		7,140	8,412	+1,272 (+17.8%)
⚪	withdraw	270,326	270,326		832	832		499,700	499,700		6,012	7,022	+1,010 (+16.8%)
⚪	withdraw_nft	266,680	266,680		1,440	1,440		527,400	527,400		6,155	7,255	+1,100 (+17.9%)

Contract: logic

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	get_escrow	298,866	298,866		192	192		456,000	456,000		6,549	7,729	+1,180 (+18.0%)
⚪	secret_key_to_public_keys	296,331	296,331		192	192		456,000	456,000		6,520	7,690	+1,170 (+17.9%)
⚪	share_escrow	245,424	245,424		1,952	1,952		520,700	520,700		5,729	6,794	+1,065 (+18.6%)

Contract: multitoken

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	222,468	222,468		832	832		499,700	499,700		5,336	6,331	+995 (+18.6%)
⚪	burn_public	185,539	185,539		416	416		638,286	638,286		5,019	5,970	+951 (+18.9%)
⚪	initialize_transfer_commitment	188,484	188,484		768	768		474,500	474,500		5,054	6,014	+960 (+19.0%)
⚪	mint_to_private	239,217	239,217		1,408	1,408		511,400	511,400		5,716	6,712	+996 (+17.4%)
⚪	mint_to_public	185,539	185,539		416	416		637,794	637,794		5,031	5,949	+918 (+18.2%)
⚪	transfer_private_to_commitment	225,577	225,577		1,024	1,024		511,400	511,400		5,417	6,411	+994 (+18.3%)
⚪	transfer_private_to_private	278,917	278,917		2,048	2,048		555,100	555,100		6,029	7,158	+1,129 (+18.7%)
⚪	transfer_private_to_public	254,364	254,364		1,056	1,056		714,671	714,671		5,853	6,925	+1,072 (+18.3%)
⚪	transfer_public_to_commitment	185,539	185,539		640	640		663,507	663,507		5,028	5,989	+961 (+19.1%)
⚪	transfer_public_to_private	246,797	246,797		1,024	1,024		683,952	683,952		5,746	6,837	+1,091 (+19.0%)
⚪	transfer_public_to_public	185,539	185,539		480	480		673,499	673,499		5,056	5,999	+943 (+18.7%)

Contract: nft

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	223,523	223,523		416	416		661,046	661,046		5,553	6,569	+1,016 (+18.3%)
⚪	burn_public	185,539	185,539		448	448		670,028	670,028		5,025	5,969	+944 (+18.8%)
⚪	mint_to_private	268,061	268,061		1,600	1,600		735,336	735,336		6,076	7,196	+1,120 (+18.4%)
⚪	mint_to_public	185,539	185,539		448	448		670,712	670,712		5,021	5,990	+969 (+19.3%)
⚪	transfer_private_to_private	211,981	211,981		832	832		499,700	499,700		5,253	6,240	+987 (+18.8%)
⚪	transfer_private_to_public	223,550	223,550		416	416		659,252	659,252		5,541	6,585	+1,044 (+18.8%)
⚪	transfer_public_to_private	240,913	240,913		992	992		683,262	683,262		5,697	6,748	+1,051 (+18.4%)
⚪	transfer_public_to_public	185,539	185,539		384	384		633,279	633,279		5,041	5,972	+931 (+18.5%)

Contract: token

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	250,779	250,779		1,024	1,024		713,951	713,951		5,845	6,899	+1,054 (+18.0%)
⚪	burn_public	185,539	185,539		448	448		672,626	672,626		5,056	5,969	+913 (+18.1%)
⚪	initialize_transfer_commitment	188,484	188,484		768	768		474,500	474,500		5,029	6,095	+1,066 (+21.2%)
⚪	mint_to_private	281,953	281,953		2,144	2,144		738,064	738,064		6,223	7,438	+1,215 (+19.5%)
⚪	mint_to_public	185,539	185,539		448	448		672,221	672,221		5,069	5,986	+917 (+18.1%)
⚪	transfer_private_to_commitment	222,045	222,045		992	992		511,400	511,400		5,388	6,389	+1,001 (+18.6%)
⚪	transfer_private_to_private	286,325	286,325		2,592	2,592		557,600	557,600		6,121	7,203	+1,082 (+17.7%)
⚪	transfer_private_to_public	250,831	250,831		1,024	1,024		714,017	714,017		5,837	6,901	+1,064 (+18.2%)
⚪	transfer_private_to_public_with_commitment	254,753	254,753		1,600	1,600		747,317	747,317		5,872	6,956	+1,084 (+18.5%)
⚪	transfer_public_to_commitment	185,539	185,539		576	576		662,520	662,520		5,022	6,070	+1,048 (+20.9%)
⚪	transfer_public_to_private	244,762	244,762		992	992		683,298	683,298		5,767	6,805	+1,038 (+18.0%)
⚪	transfer_public_to_public	185,539	185,539		448	448		672,542	672,542		5,078	5,963	+885 (+17.4%)

Contract: vault

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	deposit_private_to_private	362,767	362,767		1,312	1,312		878,227	878,227		7,254	8,574	+1,320 (+18.2%)
⚪	deposit_private_to_private_exact	471,194	471,194		1,888	1,888		915,295	915,295		9,116	10,773	+1,657 (+18.2%)
⚪	deposit_private_to_public	308,983	308,983		768	768		862,252	862,252		6,583	7,770	+1,187 (+18.0%)
⚪	deposit_public_to_private	298,960	298,960		1,984	1,984		965,024	965,024		6,488	7,702	+1,214 (+18.7%)
⚪	deposit_public_to_private_exact	301,691	301,691		1,952	1,952		949,448	949,448		6,491	7,689	+1,198 (+18.5%)
⚪	deposit_public_to_public	185,539	185,539		832	832		897,542	897,542		5,035	5,975	+940 (+18.7%)
⚪	issue_private_to_private_exact	471,194	471,194		1,888	1,888		915,955	915,955		8,682	10,231	+1,549 (+17.8%)
⚪	issue_private_to_public_exact	339,595	339,595		1,344	1,344		899,977	899,977		7,059	8,327	+1,268 (+18.0%)
⚪	issue_public_to_private	275,652	275,652		1,376	1,376		921,640	921,640		6,136	7,283	+1,147 (+18.7%)
⚪	issue_public_to_public	185,539	185,539		832	832		898,232	898,232		5,040	5,980	+940 (+18.7%)
⚪	redeem_private_to_private_exact	474,161	474,161		1,888	1,888		915,802	915,802		8,782	10,280	+1,498 (+17.1%)
⚪	redeem_private_to_public	308,930	308,930		768	768		862,696	862,696		6,614	7,788	+1,174 (+17.8%)
⚪	redeem_public_to_private_exact	304,711	304,711		1,952	1,952		949,769	949,769		6,553	7,732	+1,179 (+18.0%)
⚪	redeem_public_to_public	185,539	185,539		832	832		898,064	898,064		5,033	5,948	+915 (+18.2%)
⚪	withdraw_private_to_private	365,734	365,734		1,312	1,312		878,437	878,437		7,299	8,712	+1,413 (+19.4%)
⚪	withdraw_private_to_private_exact	474,161	474,161		1,888	1,888		915,748	915,748		8,741	10,289	+1,548 (+17.7%)
⚪	withdraw_private_to_public_exact	339,542	339,542		1,344	1,344		900,211	900,211		7,005	8,308	+1,303 (+18.6%)
⚪	withdraw_public_to_private	314,923	314,923		2,528	2,528		967,335	967,335		6,664	7,899	+1,235 (+18.5%)
⚪	withdraw_public_to_public	185,539	185,539		832	832		898,367	898,367		5,048	5,988	+940 (+18.6%)