Add a permissions block to ci.yml so the default token can drop to read

The Netlify preview step is the one consumer of the default token's
write access here; contents:read + pull-requests:write is the same
block lecture-jax/ci.yml already carries. The other workflows either
have blocks or write nothing with GITHUB_TOKEN.

Part of QuantEcon/meta#347 item 4.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mmcky

.github/workflows/ci.yml

@@ -3,6 +3,9 @@ on: [pull_request]
 jobs:
   preview:
     runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false"
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v7
         with: