Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[stefanogermano]

Potential fix for https://github.com/DeMaCS-UNICAL/PythonESE/security/code-scanning/1

In general, the fix is to explicitly define a permissions block for the workflow or for the individual job so that the GITHUB_TOKEN has only the minimal required permissions. For this workflow, the job only needs to read the repository to check out code and does not interact with issues, pull requests, or perform writes back to the repository, so contents: read is sufficient.

The best fix without changing existing functionality is to add a permissions block at the workflow root (top level, alongside name and on) so that all jobs in this workflow inherit restricted permissions. Specifically, in .github/workflows/docker-image.yml, after the name: Docker Image CI line (line 1) and before the on: block (line 3), insert:

permissions:
  contents: read

No additional methods, imports, or external dependencies are needed; this is purely a declarative change in the workflow YAML.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.