Add docstrings to vyos_user functions and workflow permissions

Adds docstrings to all undocumented module-level functions in
vyos_user.py to bring docstring coverage above the 80% threshold.
Adds explicit permissions: contents: read to codecoverage.yml
as recommended by CodeRabbit for least-privilege CI security.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>