chore(ci): declare workflow-level permissions on publish.yml

Add `permissions: contents: read` at workflow level so the four build
jobs (build-linux, build-macos-arm, build-windows, build-sdist) have
explicit GITHUB_TOKEN scoping instead of inheriting from repo defaults.

The publish job's per-job `permissions: id-token: write` block remains
unchanged. Per-job permissions replace (not merge with) workflow-level,
so that job retains only id-token: write (it doesn't checkout, so it
doesn't need contents access).

Clears 4 CodeQL `actions/missing-workflow-permissions` warnings without
changing runtime token scope (repo default was already `read`).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: igerber

.github/workflows/publish.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   # Build wheels on Linux using manylinux containers
   build-linux: