github: Restrict repo contents permissions to read-only in pr-validation

[dfawley]

RELEASE NOTES: none

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.37%. Comparing base (6207142) to head (5069885).
Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8414      +/-   ##
==========================================
+ Coverage   82.26%   82.37%   +0.11%     
==========================================
  Files         414      414              
  Lines       40424    40424              
==========================================
+ Hits        33255    33300      +45     
+ Misses       5802     5761      -41     
+ Partials     1367     1363       -4     

see 24 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.