- Validate GitHub Actions workflows and add minimum permissions

[Copilot]

Summary

Validated all GitHub Actions workflows and added minimum required permissions to follow security best practices. Without an explicit permissions block, GitHub defaults to overly broad read/write access for many scopes.

Changes

php.yml — Test & lint PHP

• Added permissions: contents: read
• The workflow only checks out code and runs composer/phpunit commands — no other permissions are needed.

check-pr-title.yml — Check PR Title

• Added permissions: pull-requests: read
• The workflow only reads the pull request title to validate it — no write or other permissions are needed.

Security notes

• Both workflows already used pinned action SHAs (good practice ✅)
• Neither workflow uses pull_request_target (no injection risk ✅)
• Permissions are set at the workflow level to apply to all jobs, restricting the GITHUB_TOKEN to the minimum required scope