ci: grant id-token permission for Codecov OIDC

The conditional use_oidc input made the action request an OIDC token, but
id-token is never part of the default GITHUB_TOKEN scope, so the exchange
failed with 'Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable' and
took the whole PHPUnit job down with it (fail_ci_if_error does not cover an
unhandled error inside the action). Request id-token: write explicitly, plus
contents: read since naming a job-level permissions block drops the rest.

Author: ruflin

.github/workflows/continuous-integration.yaml

@@ -49,6 +49,11 @@ jobs:
     runs-on: 'ubuntu-24.04'
     name: 'PHPUnit (PHP ${{ matrix.php }}, ES ${{ matrix.elasticsearch }})'
     timeout-minutes: 10
+    permissions:
+      contents: read
+      # Required for the Codecov OIDC token exchange below. id-token is never
+      # granted by default, so it has to be requested explicitly.
+      id-token: write
     strategy:
       matrix:
         php: