Resolve open Dependabot and code scanning alerts

[kroenlein]

Why

GitHub reports two open Dependabot alerts and two open code scanning warnings on this repository.

Changes

Alert	Fix
Dependabot #1, #2: pytest tmpdir handling (medium)	Pin pytest==9.0.3 on Python 3.10+ in pyproject.toml and test_requirements.txt
Code scanning #3: pr-checks.yml lacks a permissions block	Set permissions: contents: read
Code scanning #1: deploy.yml lacks a permissions block	Set permissions: contents: read

The version moves to 2.3.1 so the version-bump check passes.

Notes

• pytest 9 requires Python 3.10, so Python 3.9 keeps pytest 8.4.2. No patched pytest runs on 3.9. The flaw affects pytest's temporary directories during test runs, not the published package. Dependabot may keep an alert open for the 3.9 pin until the project drops 3.9.
• The PyPI publish step authenticates with the PYPI_API_TOKEN secret, so read-only token access is enough for deploy.yml.

Testing

• Python 3.12 with pytest 9.0.3: 233 passed, 1 xfailed
• Python 3.9 with pytest 8.4.2: 233 passed, 1 xfailed
• ruff check, ruff format --check, and flake8 pass on gemd/ and tests/

🤖 Generated with Claude Code