Reverts the `actions: read` grant added in v0.45.0 on `code-workflow.yml`'s
`Code` job. A reusable-workflow job may only request permissions the calling job
grants, so declaring `actions: read` made every caller that does not grant it an
invalid workflow ("nested job 'code' is requesting actions: read, but is only
allowed actions: none"). The SARIF upload works without it; on a private repo it
leaves a non-fatal "Resource not accessible by integration" annotation, which is
the accepted trade for not breaking callers.
- The `Code` job requests only `contents: read` and `security-events: write`
again. Callers do not need to grant `actions: read`.