Update CodeQL workflow version and permissions

Author: Sandler73

.github/workflows/codeql.yml

@@ -6,11 +6,14 @@
 #               to main, pull requests targeting main, and a weekly schedule.
 #               Results publish to the repository Security tab.
 # Notes:        - security-events write permission is required for upload
+#               - If the repository has code-scanning DEFAULT SETUP enabled,
+#                 this advanced workflow's uploads are rejected; disable
+#                 default setup under Settings > Code security to use it
 #               - CodeQL Action v4 (Node.js 24 runtime); v3 enters deprecation
 #                 December 2026
 #               - Action pins follow the project standard: checkout@v6,
 #                 setup-python@v6
-# Version:      1.6.0
+# Version:      1.6.2
 # ==============================================================================
 
 name: CodeQL
@@ -39,6 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: read
       security-events: write
 
     steps:
@@ -48,6 +52,7 @@ jobs:
         uses: github/codeql-action/init@v4
         with:
           languages: python
+          build-mode: none
           queries: security-and-quality
 
       - name: Perform CodeQL analysis