fix: add explicit permissions to PR workflow to limit GITHUB_TOKEN scope

Co-authored-by: Saadnajmi <6722175+Saadnajmi@users.noreply.github.com>

Author: Copilot

.github/workflows/pr.yml

@@ -1,6 +1,9 @@
 name: PR
 on: pull_request
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true