QVAC-16473 infra: fix startup_failure in on-pr-test-sdk.yml — add missing id-token permission

[lauripiisang]

🎯 What problem does this PR solve?

• on-pr-test-sdk.yml fails with startup_failure every time it triggers — no jobs run at all
• Error: "The nested job 'android-tests' is requesting 'id-token: write', but is only allowed 'id-token: none'" (same for ios-tests)
• Root cause: caller workflow permissions are the ceiling for all nested reusable workflows. test-sdk.yml android/ios jobs need id-token: write for AWS OIDC, but on-pr-test-sdk.yml didn't grant it.

📝 How does it solve it?

• Adds id-token: write to the top-level permissions block in on-pr-test-sdk.yml
• Verified this is the only missing permission across the full chain: on-pr-test-sdk.yml -> test-sdk.yml -> test-{desktop,android,ios}-sdk.yml

🧪 How was it tested?

• Reproduced: https://github.com/tetherto/qvac/actions/runs/24774882344
• After merge, re-apply test-e2e-smoke or test-e2e-full label on PR test: update docs for tests-qvac #1703 to verify

[github-actions]

Tier-based Approval Status

**PR Tier:** TIER1

**Current Status:** ✅ APPROVED

**Requirements:**
- 1 Team Member approval ✅ (1/1)
- 1 Team Lead OR Management approval ✅ (1/1)



---
*This comment is automatically updated when reviews change.*