Restrict GITHUB_TOKEN permissions in the cron Conda workflow

[Copilot]

This updates the Conda maintenance workflow to use explicit least-privilege token permissions. The workflow now defaults to read-only repository access and elevates write access only for the job that commits repository changes.

• Workflow permission baseline

  • Add a root-level permissions block to /home/runner/work/PyPCAPKit/PyPCAPKit/.github/workflows/cron-conda.yml
  • Set the default GITHUB_TOKEN scope to contents: read

• Job-scoped write access

  • Add a job-level override for conda-update
  • Grant contents: write only where the workflow creates and pushes repository changes

• Result

  • Reduces default token scope for the workflow
  • Preserves required write access for the update job without broadening other jobs

permissions:
  contents: read

jobs:
  conda-update:
    permissions:
      contents: write