ci: declare workflow-level contents: read on essential-ci and check-pebble-dep

[arpitjain099]

Both workflows are pure checks: github-actions-essential-ci runs the essential CI suite, check-pebble-dep validates the pebble dependency reference. No GitHub API writes from the workflows.

Same post-CVE-2025-30066 (tj-actions/changed-files) hardening pattern. YAML validated locally.

[trunk-io]

Merging to master in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[blathers-crl]

Thank you for contributing to CockroachDB. Please ensure you have followed the guidelines for creating a PR.

Before a member of our team reviews your PR, I have some potential action items for you:

• Please ensure your git commit message contains a release note.
• When CI has completed, please ensure no errors have appeared.

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[cockroach-teamcity]

This change is 

[cockroachlabs-cla-agent]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}