ci: add contents: read permission to package job for OIDC

Author: gunnargrosch

.github/workflows/release.yml

@@ -82,6 +82,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       id-token: write  # required for npm trusted publishing (OIDC)
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
@@ -120,9 +121,9 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Publish to npm
         if: startsWith(github.ref, 'refs/tags/v')
-        run: cd npm && npm publish --access public --provenance
+        run: cd npm && npm publish --access public