fix(security): autofix Overly Broad Permissions in GitHub Actions Workflows is risky (#303)

Co-authored-by: aikido-autofix[bot] <119856028+aikido-autofix[bot]@users.noreply.github.com>

Author: aikido-autofix[bot]

.github/workflows/release.yml

@@ -5,13 +5,14 @@ on:
     tags:
       - 'v*'
 
-permissions:
-  id-token: write  # Required for OIDC trusted publishing
-  contents: write  # Required for creating GitHub releases
+permissions: {}
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # Required for creating GitHub releases
+      id-token: write  # Required for OIDC trusted publishing
     # Bind workflow-context values to env up front. Steps reference these
     # as shell variables ($TAG, $REPO, $COMMIT_SHA) instead of `${{ }}`
     # template interpolation, so attacker-controlled tag names cannot be