Backport workflow-hardening fix (excessive-permissions) to 3 release branches

Summary

The default branch already hardened .github/workflows/codeql-analysis.yml against the issue(s) below, but 3 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• https://github.com/appwrite/appwrite/commit/f8b89b2294b4514d9d4be3096a9e92a2aabb503e

Affected release branches (3)

• release-sdks (still present as of HEAD 88911bf6)
• 1.4.x (still present as of HEAD 5cfaee42)
• 1.5.x (still present as of HEAD 64868968)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-sdks — excessive-permissions

File .github/workflows/codeql-analysis.yml; suggested edits:

• • jobs.$J.permissions.security-events = 'write'
• • permissions.contents = 'read'

--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -64,3 +64,7 @@
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v2
+    permissions:
+      security-events: write
+permissions:
+  contents: read

1.4.x — excessive-permissions

File .github/workflows/codeql-analysis.yml; suggested edits:

• • jobs.$J.permissions.security-events = 'write'
• • permissions.contents = 'read'

--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -64,3 +64,7 @@
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v2
+    permissions:
+      security-events: write
+permissions:
+  contents: read

1.5.x — excessive-permissions

File .github/workflows/codeql-analysis.yml; suggested edits:

• • jobs.$J.permissions.security-events = 'write'
• • permissions.contents = 'read'

--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -64,3 +64,7 @@
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v2
+    permissions:
+      security-events: write
+permissions:
+  contents: read

---

Happy to open pull requests instead if that's preferred.