Feat: Enable Auth Scheme selection

[0xnullifier]

Closes 0xMiden/feedback#121

This is how the extra step looks like

Content is subject to change

[0xnullifier]

Builds on top of #78 and #76

To fix this, add an explicit permissions block that follows least privilege. The simplest and safest approach is:

• At the workflow (top) level, set permissions: contents: read to cover the CI-style jobs that only need to read code and run tests (ci, coverage, i18n-check).
• For the translations job, override permissions with a job-level permissions block that allows writing to repository contents so that git push works, while keeping other scopes at default minimal levels (i.e., unspecified and thus effectively none).

Concretely:

• Edit .github/workflows/pr.yml.
• After the name: PR Tests line, add a top-level permissions: block with contents: read.
• Under the translations: job (same indentation level as name, runs-on), add a permissions: block with contents: write.

This keeps existing functionality: translations can still commit and push translation updates, while the rest of the jobs have only read access to repo contents. No other imports or definitions are needed, as this is pure YAML configuration for GitHub Actions.

In general, the problem is fixed by explicitly specifying a permissions: block for the workflow or for individual jobs, granting only the minimal scopes needed. Since all of the shown jobs only need to read the repository contents (via actions/checkout) and do not perform any write operations back to GitHub, setting contents: read is sufficient and aligns with the CodeQL “minimal starting point” suggestion.

The best way to fix this without changing existing functionality is to add a top‑level permissions: block right under the workflow name: and before the on: key in .github/workflows/pr.yml. This way, the permission setting applies to all jobs that do not override it (which includes translations, ci, coverage, and i18n-check as shown). Concretely, you should insert:

permissions:
  contents: read

between the existing line name: PR Tests and the on: block. No changes are needed inside the individual jobs, and no imports or additional methods are required since this is purely a workflow configuration change.

In general, the fix is to add an explicit permissions block to the workflow and/or individual jobs so that the GITHUB_TOKEN has only the minimal scopes required. Jobs that don’t need to modify repository contents (like ci, coverage, and i18n-check) should have contents: read. The translations job, which commits and pushes generated translation files back to the repo, needs contents: write.

The cleanest way to do this without changing behavior is:

• Add a workflow-level permissions: contents: read so that all jobs default to read-only.
• Override the translations job with permissions: contents: write so it can still push changes.
  This addresses the CodeQL warning (including for i18n-check) and enforces least privilege. No additional imports or external dependencies are required; all changes are within .github/workflows/pr.yml.

Concretely:

• Edit .github/workflows/pr.yml near the top to add:

permissions:
  contents: read

right after the name: PR Tests (and before on:).

• Edit the translations job definition to add:

permissions:
  contents: write

between runs-on: ubuntu-latest and outputs:.