ci(svf-validation): declare permissions: {contents: read} (#222)

The other 16 workflows in .github/workflows/ declare a top-level
permissions block; svf-validation.yml was missed. Bring it in line with
the sibling convention.

Today the job runs first-party actions only (actions/checkout,
actions/setup-python) plus 'make validate-svf-contracts', so an
over-broad default token has no direct exploit path. The failure mode
being closed off is future drift: a later step adds a third-party
action, or make invokes a script that ends up with GITHUB_TOKEN, and
the workflow inherits the repo default of read+write on contents/PRs/
issues instead of the explicit read this file should always have had.

Author: mdheller

.github/workflows/svf-validation.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   sourceos-svf-contracts:
     runs-on: ubuntu-latest