ci: workflows get only read access; drop the disabled CodeQL workflow

The test and lint workflows set no permissions, so their GITHUB_TOKEN
had the repository's default access (CodeQL
actions/missing-workflow-permissions). Both only check out and build
the code: they now ask for contents: read.

.github/workflows/codeql-analysis.yml was disabled on GitHub; code
scanning runs through GitHub's default CodeQL setup instead. The file
only kept the old analysis category (and its 2023 alerts) around.

.github/workflows/test.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [master]
 
+# the jobs only read the code
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Python ${{ matrix.python-version }}