[sec-check] pr-validation.yml: add top-level permissions block (contents: read) (#1038)

check-base-branch and validate jobs declared no permissions, so their
GITHUB_TOKEN inherited the repository default. Both are read-only.
unit-tests and testsuite jobs already declare explicit permissions and
are unaffected (job-level permissions override the workflow default).

Fixes #1029

Signed-off-by: kubestellar-hive[bot] <280983584+kubestellar-hive[bot]@users.noreply.github.com>
Co-authored-by: kubestellar-hive[bot] <280983584+kubestellar-hive[bot]@users.noreply.github.com>

Author: kubestellar-hive[bot]

.github/workflows/pr-validation.yml

@@ -6,6 +6,9 @@ on:
       - testing
   merge_group:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}