ci: declare workflow-level contents: read on 2 workflows (#3367)

Pins the default `GITHUB_TOKEN` to `contents: read` on 2 workflows in
`.github/workflows/` that don't call a GitHub API beyond the initial
checkout.

The following files were left implicit because they reference
`GITHUB_TOKEN` / use a write-scope action / trigger on
`pull_request_target`. Those scopes are best declared by maintainers:
`docker-builds.yml`, `lint.yaml`.

## Why

CVE-2025-30066 (March 2025 `tj-actions/changed-files` supply-chain
compromise) exfiltrated `GITHUB_TOKEN` from workflow logs. Pinning per
workflow caps runtime authority irrespective of the repo or org default,
gives drift protection if the default ever widens, and is credited
per-file by the OpenSSF Scorecard `Token-Permissions` check.

YAML validated locally with `yaml.safe_load` on each touched file.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Author: arpitjain099

.github/workflows/unit_test_cpu.yaml

@@ -13,6 +13,9 @@ concurrency:
   group: unit-test${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build-test:
     uses: pytorch/test-infra/.github/workflows/linux_job_v2.yml@main

.github/workflows/unit_test_cpu_torchft.yaml

@@ -15,6 +15,9 @@ concurrency:
   group: unit-test${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build-test:
     uses: pytorch/test-infra/.github/workflows/linux_job_v2.yml@main