fix(ci): add contents read permission for private repo checkout

Author: peidrao

.github/workflows/release-test.yml

@@ -12,6 +12,7 @@ jobs:
     environment: release-test
     permissions:
       id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/release.yml

@@ -11,6 +11,7 @@ jobs:
     environment: release
     permissions:
       id-token: write  # required for trusted publishing (OIDC)
+      contents: read
 
     steps:
       - uses: actions/checkout@v4