fix(ci): grant contents:read so desktop builds can clone the internal fork

The reusable build jobs ran with permissions: {} (fine for upstream's public
repo, which checks out with no token). This fork is internal, so checkout failed
with 'Repository not found'. Grant contents:read on the linux/macos/windows
caller jobs and the reusable build jobs, mirroring the prepare job.

.github/workflows/build_desktop_macos.yaml

@@ -76,6 +76,9 @@ jobs:
         name: Build macOS Universal
         runs-on: macos-26 # M1
         environment: ${{ inputs.sign && 'Desktop Apple' || '' }}
+        # contents:read so the checkout can clone the fork when it is a private/internal repo
+        permissions:
+            contents: read
         steps:
             - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
               with: