CICD: Restrict permissions in .github/workflows/pr_build.yml

[tlimoncelli]

Potential fix for https://github.com/StackExchange/dnscontrol/security/code-scanning/36

In general, the fix is to explicitly define permissions for the GITHUB_TOKEN in the workflow, restricting it to the least privileges needed. Since this workflow only checks out code, uses caches, runs tests, uploads artifacts, and runs GoReleaser builds without creating releases or pushing tags, it should only require read access to repository contents.

The best way to fix this without changing existing functionality is to add a permissions block near the top of the workflow (at the root level, alongside name, on, and env). This will apply to all jobs that do not override permissions. We should set contents: read, which matches the minimal recommendation in the CodeQL message and is sufficient for actions/checkout and other used actions. No additional scopes (like pull-requests: write or packages: write) appear necessary based on the provided snippet.

Concretely, in .github/workflows/pr_build.yml, after the on: block (lines 6–15) and before the env: block (line 18), insert:

permissions:
  contents: read

No imports or additional definitions are needed; this is purely a YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.