ci: set least-privilege GITHUB_TOKEN permissions for meson workflow

The meson workflow only builds and tests across platforms; none of its
jobs write to the repository, packages, or other GitHub resources. Add a
workflow-level `permissions: { contents: read }` block so the default
GITHUB_TOKEN follows least privilege instead of inheriting the broad
read/write scopes granted by default.

.github/workflows/meson.yml

@@ -6,6 +6,9 @@ concurrency:
   group: ${{github.workflow}}-${{github.head_ref}}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   Linux-GCC:
     runs-on: ubuntu-22.04