ci: declare contents: read on mock-nvml-e2e and tests

Both workflows are read-only: mock-nvml-e2e spins up a kind cluster
with DRA and runs BATS suites; tests.yaml is a placeholder that
documents the Prow-driven flow. No API writes.

Author: arpitjain099

.github/workflows/mock-nvml-e2e.yaml

@@ -34,6 +34,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   mock-gpu-e2e:
     runs-on: ubuntu-latest

.github/workflows/tests.yaml

@@ -18,6 +18,9 @@ name: tests
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   skipped:
     runs-on: ubuntu-latest