ci: declare contents:read on CI workflow

CI runs three notebook-only jobs (nbfmt, nblint, outputs-removed)
against the diff. None touch the GitHub API beyond actions/checkout.
contents:read is the minimum.

Matches the per-job permissions blocks already used in
notebook-pr-bot.yml and the workflow-level scopes documented in
build-and-deploy.yml.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Author: arpitjain099

.github/workflows/ci.yaml

@@ -6,6 +6,9 @@ on:
     paths:
     - "site/en/**"
 
+permissions:
+  contents: read
+
 jobs:
   nbfmt:
     name: Notebook format