ci: add build-docs workflow

[jimisola]

Summary

• Add caller workflow for centralized Antora docs build validation
• Runs on PRs and pushes to main when docs/** files change
• Calls reusable workflow from reqstool/.github

Test plan

• Verify Build Docs workflow passes after merge

Generally, the fix is to add an explicit permissions: block that grants only the minimal access needed to build the docs. Because this workflow simply delegates to a reusable workflow via uses:, and we cannot see any need for write access from the snippet, the safest and least intrusive change is to set workflow-wide read-only permissions (e.g., contents: read). This documents the intended access and prevents the token from having elevated privileges if repository or organization defaults are broad.

Concretely, in .github/workflows/build-docs.yml, add a permissions: section at the root level (between the on: block and jobs:) specifying read-only access. A minimal and common baseline is:

permissions:
  contents: read

This applies to all jobs (including the build job using the reusable workflow) that do not override permissions: themselves. No additional imports or methods are required since this is a YAML configuration change only, and it does not alter the functional behavior of the docs build, only the scope of the GITHUB_TOKEN.