ci: drop unused packages:write from the pull-request workflow (#3422)

## What this PR does

The `build`, `build-talos` and `finalize` jobs in `pull-requests.yaml`
each requested `packages: write`, but none of them touches GHCR: the
workflow's `REGISTRY` is OCIR and they authenticate with `OCIR_USER` /
`OCIR_TOKEN`. The only GHCR login in the file is in
`verify-release-candidate`, which has `packages: read` and is not
touched here. The scope was dead.

It is worth removing rather than leaving alone. GHCR pushes elsewhere in
CI authenticate with `GITHUB_TOKEN` plus `packages: write` rather than
with a stored secret, so on those paths the scope *is* the whole
credential, so granting it on the `pull_request` lane hands every
same-repo PR run a token carrying GHCR write authority that lane has no
use for. Whether a given package would actually honour that write
depends on its Actions access setting, which lives outside this repo, so
this is least-privilege hygiene rather than a fix for a demonstrated
exploit. It also brings the three jobs in line with the `permissions:
contents: read` default the workflow already sets at the top level.

The e2e job keeps its `packages: read`; only the write scope is removed.

Verified: `build`, `build-talos` and `finalize` log in to OCIR only
(`docker/login-action` with `OCIR_USER` / `OCIR_TOKEN`), the sole
`ghcr.io` login is in `verify-release-candidate` with `packages: read`,
unchanged. The file still parses as YAML after the change.

### Downstream repositories

- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:

Walked the trigger map in `contributing.md` against the diff. It removes
three permission lines from one workflow and changes nothing any
downstream repository restates. The nearest entry is the `ccp` one on
release-prep behaviour, which is scoped to `tags.yaml` and untouched
here.

### Release note

```release-note
NONE
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated the build, Talos build, and finalization workflows to request
read-only repository access.
  * Removed package write permissions from these workflows.
* Registry login and image publishing remain configured separately and
are unchanged. No other workflow behavior or processing steps changed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

.github/workflows/pull-requests.yaml

@@ -348,7 +348,6 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
-      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -492,7 +491,6 @@ jobs:
     timeout-minutes: 40
     permissions:
       contents: read
-      packages: write
     steps:
       - name: Checkout code
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -583,7 +581,6 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
-      packages: write
     steps:
       - name: Checkout code
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4