Add `contents:read` permission to container workflow

[garryod]

This is required to allow the workflow job to checkout the code, currently we're getting around this because our repos are public