ci: fix DangerJS workflow permissions

[tomassebestik]

Security update: Modifies DangerJS workflow permissions from contents: write to contents: read.

Enable workflow .github/workflows/dangerjs.yml when this merged - currently disabled!

[Copilot]

Pull request overview

Adjusts the GitHub Actions workflow permissions for the DangerJS PR linter to follow least-privilege by removing unnecessary write access to repository contents.

Changes:

• Change workflow permissions.contents from write to read for the DangerJS job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Because this workflow runs on pull_request_target and checks out the PR head SHA, any step/action that reads and executes repository content from the checkout could be influenced by untrusted fork PRs. Consider avoiding checkout of the head ref in a pull_request_target workflow (e.g., checkout the base ref instead, or have the action rely on the GitHub API), or otherwise harden the job so no PR-controlled code/config is executed.