ci: add build-docs workflow

[jimisola]

Summary

• Add caller workflow for centralized Antora docs build validation
• Runs on PRs and pushes to main when docs/** files change
• Calls reusable workflow from reqstool/.github

Test plan

• Verify Build Docs workflow passes after merge

In general, the fix is to add an explicit permissions block that grants only the minimal GITHUB_TOKEN scopes required by this workflow. Because this workflow’s sole job delegates to a reusable workflow that builds documentation, it almost certainly only needs read access to repository contents and packages. GitHub’s recommended baseline for read‑only is permissions: contents: read (and optionally packages: read), which satisfies the CodeQL rule and documents intended access.

The single best fix here, without changing functionality, is to define permissions at the workflow root so that it applies to all jobs (including the build job that calls the reusable workflow). We’ll add, just below the on: block, a permissions: section that limits contents to read (and optionally packages to read if you want parity with GitHub’s recommended read‑only defaults). This does not change how the reusable workflow is invoked; it only constrains the GITHUB_TOKEN for this workflow’s jobs. Concretely, in .github/workflows/build-docs.yml, between the on: block (lines 2–11) and jobs: (line 13), we’ll insert:

permissions:
  contents: read

No imports or additional methods are needed because this is declarative YAML configuration, not executable code.