ci: restrict workflow token permissions

[saagpatel]

What

• Adds explicit contents: read permissions to desktop-ci and quality-gates.

Why

• CodeQL flagged both workflows for relying on broad default GITHUB_TOKEN permissions.

How

• Uses a workflow-level permission block so checkout and read-only CI steps keep working with least privilege.

Testing

• Commands run:
  • Not run locally (remote workflow-only change).
• Results:
  • PR checks will validate the workflows on GitHub.

Performance impact

• Bundle delta: None expected.
• Build time delta: None expected.
• Lighthouse delta: None expected.
• API latency delta: None expected.
• DB query delta: None expected.

Risk / Notes

• Low risk; CI token permissions are read-only and no lockfiles changed.

Screenshots (UI only)

• N/A

Lockfile rationale (if lockfile changed)

• N/A

Baseline governance (if .perf-baselines changed)

• perf-baseline-update label applied: N/A
• Reviewer signoff: N/A
• Rollback note: Revert this PR if a workflow unexpectedly needs broader token permissions.