fix(security): resolve CodeQL alerts for logging, URL sanitization, and workflow permissions

- Remove api_key debug print blocks from relation_extractor.py and triplet_extractor.py (CWE-532 clear-text logging)
- Replace URL substring check with exact equality in test_web_ingestor.py (CWE-20 incomplete sanitization)
- Add `permissions: contents: read` to benchmark.yml and security.yml workflows (least-privilege)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/benchmark.yml

@@ -10,6 +10,9 @@ on:
       - '**/*.md'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   performance-test:
     name: Benchmark Runner (Ubuntu/Python 3.12)

.github/workflows/security.yml

@@ -5,6 +5,9 @@ on:
     - cron: '0 0 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   audit:
     runs-on: ubuntu-latest