Add security-events: write permissions to CodeQL analysis workflows

[Copilot]

This PR ensures that CodeQL analysis workflows have the correct permissions configuration as required by GitHub security best practices.

Changes Made

Added security-events: write permission at the job level to both CodeQL analysis workflows:

• auto-merge/contrib/.github/workflows/codeql-analysis.yml
• auto-merge/js/.github/workflows/codeql-analysis.yml

Before

jobs:
  CodeQL-Build:
    runs-on: ubuntu-latest

    steps:
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

After

jobs:
  CodeQL-Build:
    runs-on: ubuntu-latest
    permissions:
      security-events: write

    steps:
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

Why This Change Is Needed

• CodeQL analysis jobs that use github/codeql-action/analyze require security-events: write permission to upload security scanning results to GitHub's code scanning dashboard
• Job-level permissions follow the principle of least privilege and are preferred over workflow-level permissions
• This ensures compliance with GitHub's security scanning requirements and best practices

Both workflows now have the proper permissions to successfully upload their analysis results without permission errors.

Fixes #11.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.