fix(ci): grant pull-requests: read to the semantic-PR check (#175)

The workflow granted contents: read, but common-check-semantic-pr.yml needs
pull-requests: read to inspect the PR title -- and a callee may not request more
than it is granted, so the run was rejected before any job started.

This is the second half of the fix: the earlier change repointed the reference
from a pinned SHA that predates the file to @main, which resolved the workflow;
this grants it the permission it actually needs. Between the two, PR titles have
not been validated in this repo since the reference broke.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/workflows/check-semantic-pr.yml

@@ -6,7 +6,9 @@ on:
     types: [opened, edited, synchronize, reopened]
 
 permissions:
-  contents: read
+  # The callee reads PR metadata to validate the title; contents is not enough,
+  # and a callee may not request more than it is granted.
+  pull-requests: read
 
 jobs:
   check: