ci(tsp-client): declare contents: read

Last workflow in .github/workflows here without a top-level permissions
block. tsp-client tests only check out, npm ci/build/test/format - no
GitHub API surface. Matches eng-common-tsp-client-test.yml and the
other already-hardened sibling workflows.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Author: arpitjain099

.github/workflows/tsp-client-tests.yml

@@ -12,6 +12,9 @@ on:
       - .github/workflows/tsp-client-tests.yml
       - tools/tsp-client/**
 
+permissions:
+  contents: read
+
 jobs:
   tsp-client:
     strategy: