ci(publish): add permissions for OIDC and content access

Author: zachowj

.github/workflows/publish.yml

@@ -3,6 +3,10 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest