ci: grant contents: read permission

The empty `permissions: {}` block strips the default token permissions,
leaving only `metadata: read`. Checkout in the reusable workflow then
hits "Repository not found" because it can't authenticate the fetch.

Author: antfu

.github/workflows/ci.yml

@@ -6,7 +6,8 @@ on:
   pull_request:
     branches: [main]
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   unit-test: