🌱 Declare contents: read permissions for pr-verify action

The PR title verifier workflow uses pull_request_target and only reads
github.event.pull_request.title from the event payload, then runs
./hack/verify-pr-title.sh. It performs no git pushes, comments, or release
operations, so contents: read is the right floor for the GITHUB_TOKEN.

Mirrors the same change already approved + merged in
kubernetes-sigs/cluster-api-provider-vsphere#4005 per @sbueringer's
suggestion.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>