Grant id-token write for cosign OIDC signing

Shipyard's release script now signs pushed images with cosign
keyless (Sigstore OIDC), which requires id-token: write on the
release workflow. Replace the empty permissions block with the
minimal set: id-token: write for OIDC and contents: read for
checkout.

Signed-off-by: Daniel Farrell <dfarrell@redhat.com>

Author: dfarrell07

.github/workflows/release.yml

@@ -8,7 +8,9 @@ on:
       - release-0.19
       - release-*
 
-permissions: {}
+permissions:
+  id-token: write   # cosign keyless via Sigstore OIDC
+  contents: read
 
 jobs:
   release: