fix(security): api-test-coverage — deny-by-default permissions

The workflow triggers on `pull_request` and runs PR-supplied scripts
(`tests/newman/run-all.sh`) inside a CI container, copying the entire
working tree in via `tar | docker exec`. With no `permissions:` block
the job inherits the repo-default GITHUB_TOKEN scope, which on some
org configs grants `pull-requests: write` (comment/approve/push back).

Add a workflow-level + job-level `permissions: contents: read`. The
suite only needs to clone the PR ref. If a future step writes
artifacts/comments, scope it explicitly on that job rather than
relaxing the default.

Pinning `pgvector/pgvector:pg16` and `nextcloud:32-apache` to digests
(reviewer's second recommendation) is left as a follow-up — getting
the wrong digest breaks CI immediately and digest lookup needs Docker
Hub access at commit time.

Refs: #1419 review (blocker 8) — discussion_r3187494448

Author: rubenvdlinde

.github/workflows/api-test-coverage.yml

@@ -13,6 +13,15 @@
 
 name: api-test-coverage
 
+# SECURITY: deny-by-default permissions for the GITHUB_TOKEN at the
+# workflow level. The job below runs PR-supplied scripts
+# (tests/newman/run-all.sh) inside a CI container, so a malicious PR
+# could otherwise exfiltrate the token or use it to comment/approve/
+# push. `contents: read` is the only scope the suite needs (clones the
+# PR ref). Override per-job if a future step needs more.
+permissions:
+  contents: read
+
 on:
   push:
     branches: [development, main]
@@ -30,6 +39,8 @@ jobs:
     name: Newman API Test Suite
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repo