security: write the release from the release job only (SonarCloud S8233) (#2021)

The workflow-level contents: write granted every job the right to push
tags and releases; the reusable release workflow is the only job that
needs it. Workflow level drops to read.

🤖 Generated with Codebuff

Co-authored-by: Codebuff <noreply@codebuff.com>

.github/workflows/release.yml

@@ -11,7 +11,7 @@ on:
         default: ""
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: release-${{ github.ref }}
@@ -59,6 +59,9 @@ jobs:
 
   release:
     needs: git-sources
+    permissions:
+      # The reusable release workflow tags and uploads the draft release.
+      contents: write
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with: