ci: resolve code-scanning alerts

[fastrevmd-lab]

Resolves open code-scanning alerts. Workflow token is now least-privilege; test/example output no longer echoes secret-looking values; remaining production-code alerts are false positives left for triage (no code change).

Alert	Rule	Location	Class	Action
1-5	actions/missing-workflow-permissions	.github/workflows/ci.yml:21,49,73,87,105	REAL (config)	Top-level permissions: contents: read; no job needs more
6	rust/cleartext-logging	src/session.rs:2360	FALSE POSITIVE	Buffer push into a VecDeque, not a log sink; dismiss-candidate
7	rust/cleartext-logging	rustnetconf-cli/src/inventory.rs:264	TEST	Assert message no longer prints the Debug dump
8	rust/cleartext-logging	tests/integration_vsrx.rs:625	TEST	Assert message no longer echoes the value
9	rust/cleartext-logging	examples/get_config.rs:77	EXAMPLE	Output no longer prints the session id
10	rust/cleartext-logging	examples/edit_config.rs:86	EXAMPLE	Output no longer prints the session id
11-19	rust/cleartext-logging	rustnetconf-cli/src/commands/{confirm,apply x3,get,plan,validate,rollback}.rs, connect.rs	FALSE POSITIVE	Prints only device label/host; password is a redacted secret type never formatted; dismiss-candidate
20	rust/hard-coded-cryptographic-value	tests/integration_vsrx.rs:125	TEST	Runtime-generated throwaway password
21	rust/hard-coded-cryptographic-value	tests/integration_vsrx.rs:157	TEST	Runtime-generated throwaway password

Verified: fmt, clippy (all targets/features, -D warnings), cargo test --workspace --locked and --all-features all pass.

🤖 Generated with Claude Code

Paperclip: MEC-3081

[fastrevmd-lab]

Superseded by #134.