Potential fix for code scanning alert no. 194: Workflow does not contain permissions

[mgtennant]

Potential fix for https://github.com/bcgov/nr-ticdi/security/code-scanning/194

To fix the problem, explicitly define permissions for the workflow or for the affected jobs so the GITHUB_TOKEN does not implicitly inherit broad repository defaults. The safest general approach is to add a restrictive permissions block at the workflow root (applies to all jobs) and then override/expand only where needed.

In this file, the only job that currently declares permissions is promote (packages: write). The vars, deploy-test, and deploy-prod jobs do not appear to need write access to repository contents or other scopes; they mostly call actions and a reusable workflow and use secrets. The single best minimal change is to add a root-level permissions block near the top of the file (after name: and before on:) that sets all scopes to read-only by default. Jobs that require broader permissions (like promote) will continue to override this with their own permissions block, which already exists. No imports or additional methods are needed; this is a pure YAML configuration change in .github/workflows/merge.yml.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.