chore(winget): add explicit permissions block to suppress CodeQL warning