ci(rust): add explicit contents:read permissions

Addresses CodeQL workflow-permissions findings on rust.yml jobs
(fmt, clippy, test, ts-bindings, build). Top-level block applies
to every job since none of them need write access.

Author: joshuaboys

.github/workflows/rust.yml

@@ -4,24 +4,27 @@ on:
   push:
     branches: [dev, main]
     paths:
-      - "crates/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "rust-toolchain.toml"
-      - ".github/workflows/rust.yml"
+      - 'crates/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - '.github/workflows/rust.yml'
   pull_request:
     branches: [dev, main]
     paths:
-      - "crates/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "rust-toolchain.toml"
-      - ".github/workflows/rust.yml"
+      - 'crates/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - '.github/workflows/rust.yml'
 
 concurrency:
   group: rust-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1