allow workflow to read the repo contents

Turns out if you don't tell it it can do something, it won't be able to
do that thing.

Signed-off-by: Xe Iaso <xe@tailscale.com>

.github/workflows/nix.yaml

@@ -6,6 +6,7 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       packages: write
     steps:
     - uses: actions/checkout@v3