ci: grant pull-requests and checks write to the coverage job

The job posts a coverage comment on the PR and the step fails with
"Resource not accessible by integration" because the token is read-only.
Declare the permissions the job needs, as the js-core and typescript
coverage workflows already do.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: reeshika-h

.github/workflows/unit-testing.yml

@@ -9,6 +9,10 @@ on:
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
 
     steps:
       - name: 🧾 Checkout repository