Potential fix for code scanning alert no. 5: Workflow does not contain permissions

[crossle]

Potential fix for https://github.com/MixinNetwork/flutter-app/security/code-scanning/5

The optimal fix is to add an explicit permissions block to the build-windows job, restricting its permissions to the minimum necessary. Since the job uploads artifacts and uses a third-party upload step gated on tags (presumably for release), the generally safe and best-practice baseline is to grant read-only contents permissions, unless a specific step in the job demands more.
From inspection, the job uploads artifacts with actions/upload-artifact (which does not require contents: write) and uses svenstaro/upload-release-action gated on tags (which utilizes the repo_token secret for uploading to releases; this generally requires contents: write).
Thus, if the tag upload is needed for this job, contents: write is safest and mirrors the permissions already set in similar jobs. However, for minimal exposure, consider the same as the other jobs:

permissions:
  contents: write

This block should be added directly under build-windows: (i.e., after line 276), before the steps: block.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.