ci: fix CodeQL permissions for private repositories

[apcha-oai]

Summary

• Grant the CodeQL workflow actions: read alongside its existing contents: read and security-events: write permissions.
• Allow the shared SDK workflow to read workflow-run metadata when it runs in the mirrored private repository.

Why

The public workflow currently succeeds because public Actions workflow-run metadata can be read without an explicit Actions permission. The identical workflow fails in the private mirror with Resource not accessible by integration while preparing to upload CodeQL results.

Validation

• Parsed the workflow as YAML and verified the complete least-privilege permission set.
• Confirmed the PR changes only one line in .github/workflows/codeql.yml.
• Verified the exact commit passed internal CodeQL: https://github.com/openai/openai-python-internal/actions/runs/31671272628

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 11.391s for Python SDK PR #3606.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	183ms
tests/chat-completions-create.test.ts	✅ Passed	261ms
tests/chat-completions-stream.test.ts	✅ Passed	133ms
tests/files-content-binary.test.ts	✅ Passed	245ms
tests/files-create-multipart.test.ts	✅ Passed	181ms
tests/files-list-pagination.test.ts	✅ Passed	166ms
tests/initialize-config.test.ts	✅ Passed	200ms
tests/instance-isolation.test.ts	✅ Passed	216ms
tests/models-list.test.ts	✅ Passed	284ms
tests/responses-background-lifecycle.test.ts	✅ Passed	269ms
tests/responses-body-method-errors.test.ts	✅ Passed	296ms
tests/responses-cancel-timeout.test.ts	✅ Passed	209ms
tests/responses-cancel.test.ts	✅ Passed	193ms
tests/responses-compact-retries.test.ts	✅ Passed	329ms
tests/responses-compact.test.ts	✅ Passed	286ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	324ms
tests/responses-create-advanced.test.ts	✅ Passed	252ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.203s
tests/responses-create-errors.test.ts	✅ Passed	181ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	248ms
tests/responses-create-retries.test.ts	✅ Passed	282ms
tests/responses-create-stream-failures.test.ts	✅ Passed	134ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	230ms
tests/responses-create-stream-wire.test.ts	✅ Passed	3.793s
tests/responses-create-stream.test.ts	✅ Passed	98ms
tests/responses-create-terminal-states.test.ts	✅ Passed	254ms
tests/responses-create-timeout.test.ts	✅ Passed	214ms
tests/responses-create.test.ts	✅ Passed	279ms
tests/responses-delete.test.ts	✅ Passed	226ms
tests/responses-input-items-errors.test.ts	✅ Passed	329ms
tests/responses-input-items-list.test.ts	✅ Passed	361ms
tests/responses-input-items-options.test.ts	✅ Passed	272ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	253ms
tests/responses-input-tokens-count.test.ts	✅ Passed	235ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.887s
tests/responses-not-found-errors.test.ts	✅ Passed	252ms
tests/responses-parse.test.ts	✅ Passed	413ms
tests/responses-retrieve-retries.test.ts	✅ Passed	226ms
tests/responses-retrieve.test.ts	✅ Passed	280ms
tests/responses-stored-method-errors.test.ts	✅ Passed	626ms
tests/retry-behavior.test.ts	✅ Passed	3.201s
tests/sdk-error-shape.test.ts	✅ Passed	297ms

View OkTest run #31671505234

_{SDK merge (e4fcae6dbf73) · head (bc7a5786fc84) · base (a1eeab58db02) · OkTest (a845fa206fa4)}