ci: drop workflow-perms cap on reusable-workflow callers

codeql.yml, pr-checks.yml and unit-tests.yml only call reusable workflows. A
caller's workflow-level permissions cap the GITHUB_TOKEN for the called
workflow, which cannot request more than the caller grants. The contents: read
block here was stripping scopes the callees need:

- codeQLworkflow.yml needs security-events: write and actions: read to upload
  CodeQL results to Code Scanning (the issue @akurtakov asked to correct)
- verifyFreezePeriod.yml needs issues: read
- checkMergeCommits.yml needs pull-requests: read
- publishTestResults.yml needs checks: write, pull-requests: write,
  issues: read and actions: read

Revert the permissions block on these three reusable-only callers; each
reusable workflow already declares its own least-privilege permissions. The
contents: read additions on the remaining workflows in this PR are kept.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Author: arpitjain099

.github/workflows/codeql.yml

@@ -8,9 +8,6 @@ on:
   schedule:
     - cron: '15 8 * * 1'
 
-permissions:
-  contents: read
-
 jobs:
   callCodeQLworkflow:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/codeQLworkflow.yml@master

.github/workflows/pr-checks.yml

@@ -9,9 +9,6 @@ on:
   pull_request:
     branches: [ master ]
 
-permissions:
-  contents: read
-
 jobs:
   check-freeze-period:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/verifyFreezePeriod.yml@master

.github/workflows/unit-tests.yml

@@ -6,9 +6,6 @@ on:
     types:
       - completed
 
-permissions:
-  contents: read
-
 jobs:
     check:
        uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishTestResults.yml@master