ci: set least-privilege contents:read permissions on openapi-lint workflow

Per CodeRabbit review on #13410. The job only checks out the repo and
runs Spectral, so contents:read is sufficient and avoids inheriting any
permissive repo/org default token scope.

.github/workflows/openapi-lint.yml

@@ -7,6 +7,9 @@ on:
       - '.spectral.yaml'
       - '.github/workflows/openapi-lint.yml'
 
+permissions:
+  contents: read
+
 jobs:
   spectral:
     name: Run Spectral