ci: scope release workflow token to contents read

`read-all` grants far more than the release jobs use; they only need repo read for checkout and authenticate uploads via Azure secrets. Narrow `GITHUB_TOKEN` to `contents: read`.

Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>

.github/workflows/release.yml

@@ -7,7 +7,8 @@ on:
     branches:
       - main
 
-permissions: read-all
+permissions:
+  contents: read
 
 # Note the only differences between release and canary-release jobs are:
 # - only canary passes --overwrite flag