Harden GI-2026 HF sync workflow permissions and auth URL

Agent-Logs-Url: https://github.com/SushantGautam/MedVQA/sessions/c6c48a23-7ac1-454e-9621-61ada50e1d8c

Co-authored-by: SushantGautam <16721983+SushantGautam@users.noreply.github.com>

.github/workflows/gradio-app-HuggingFaceSpace-SimulaMet-MedVQA-GI-2026.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   sync-to-hub:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v3
         with:
@@ -16,4 +18,4 @@ jobs:
       - name: Push to hub
         env:
           HF_TOKEN: ${{ secrets.HF_TOKEN }}
-        run: git push https://sushantgautam:$HF_TOKEN@huggingface.co/spaces/SimulaMet/MedVQA-GI-2026 main
+        run: git push https://oauth2:$HF_TOKEN@huggingface.co/spaces/SimulaMet/MedVQA-GI-2026 main