fix(ci): grant contents:read so desktop builds can clone the internal fork

The reusable build jobs ran with permissions: {} (fine for upstream's public
repo, which checks out with no token). This fork is internal, so checkout failed
with 'Repository not found'. Grant contents:read on the linux/macos/windows
caller jobs and the reusable build jobs, mirroring the prepare job.

.github/workflows/build_desktop_windows.yaml

@@ -86,6 +86,9 @@ jobs:
         name: Build Windows ${{ inputs.arch }}
         runs-on: windows-2025
         environment: ${{ inputs.sign && 'Desktop eSigner' || '' }}
+        # contents:read so the checkout can clone the fork when it is a private/internal repo
+        permissions:
+            contents: read
         env:
             SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
         steps: