ci: add build-docs workflow

[jimisola]

Summary

• Add caller workflow for centralized Antora docs build validation
• Runs on PRs and pushes to main when docs/** files change
• Calls reusable workflow from reqstool/.github

Test plan

• Verify Build Docs workflow passes after merge

In general, the fix is to explicitly declare a permissions block in the workflow, applying the principle of least privilege. Since this workflow only delegates to a reusable workflow and does not itself need to write to the repository, a minimal, safe default is permissions: contents: read at the top level, which applies to all jobs without their own permissions block.

The best way to fix this specific file without changing functionality is to add a root-level permissions section between the on: block and the jobs: block. This will set the default permissions for the build job that calls the reusable workflow. Concretely, in .github/workflows/build-docs.yml, insert:

permissions:
  contents: read

at line 13 (before jobs:). No imports or additional definitions are needed; this is standard GitHub Actions YAML configuration.