ci: add build-docs workflow

[jimisola]

Summary

• Add caller workflow for centralized Antora docs build validation
• Runs on PRs and pushes to main when docs/** files change
• Calls reusable workflow from reqstool/.github

Test plan

• Verify Build Docs workflow passes after merge

In general, fix this by explicitly setting a permissions: block for the workflow or for the specific job, granting only the minimal scopes required. Because this workflow only delegates to a reusable workflow and likely needs no write access itself, a conservative choice is to set contents: read at the workflow root so it applies to all jobs (including build).

Concretely, in .github/workflows/build-docs.yml, add a permissions: section directly under the name: Build Docs line (before on:) with least-privilege settings. A minimal and safe starting point that satisfies CodeQL and GitHub’s recommendations is:

permissions:
  contents: read

This does not change the functional behavior of the workflow steps themselves (they can still read the repository), but it prevents unintended write access through GITHUB_TOKEN unless explicitly re-granted elsewhere (e.g., in the reusable workflow, if needed).