fix(INFRA-3631): add read-only job-level permissions to shadow CI caller

Add job-level permissions to the shadow-ci caller job so the nested
ci.yml can start. All permissions are read-only except id-token:write
(required for Namespace runners) to avoid duplicating commit statuses
and PR comments that the normal CI pipeline already writes.

Author: alucardzom

.github/workflows/ci-namespace-shadow.yml

@@ -20,6 +20,13 @@ concurrency:
 jobs:
   shadow-ci:
     name: '[shadow] CI'
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      issues: read
+      pull-requests: read
+      statuses: read
     uses: ./.github/workflows/ci.yml
     with:
       runner_provider: namespace