feat: use contents read permission for CodeQL and semgrep analysis jobs.

[LillieEntur]

💡 What does this PR do?

The pull request aims to remove usage of contents: write during workflow jobs that execute gradle jobs.

contents: write is only needed for uploading dependency graph, and only were required when the action was running in main branch, and no cached results were found. A new job were made to isolate the contents: write to only upload the dependency graph.

Closes: SIK-1886

🔧 List of changes

• code-scan.yml
  • explicitly define github-token as input to github actions instead of being hidden by default input
  • replace contents: write with contents: read for semgrep-analysis and codeql-analysis jobs.
  • add job upload-dependency-graph

📋 Checklist

• Am familiar with the release pipeline for this project
• I have verified that the project runs as expected after the new changes