Add soup approval workflow

[nasirky]

No description provided.

To fix the problem, add a permissions block specifying the least privilege needed. For workflows that only need to read repository contents, use contents: read (or further restrict as per actual requirements). The permissions block can be added either at the workflow root (before or after on:), which applies to all jobs, or to the specific job if jobs may need differing permissions. Since this workflow only defines one job (soups), and uses a reusable workflow, adding permissions at the root is the cleanest minimal fix. Edit .github/workflows/soup-approval-verification.yml to insert a permissions: block (e.g., contents: read) above the jobs: section.

---