auto-release: pass actions:read to called publish workflow (#175)

Caller permissions cap what the reusable workflow can request. The
called publish.yml's approval job needs actions:read to read the
deployment-approvals API; without it GitHub rejects the call at
startup:

  The nested job 'approval' is requesting 'actions: read', but is
  only allowed 'actions: none'.

This was intended in PR #172 but the line didn't make it onto main.
Hotfix: add it now so the next release (3.8.3+) doesn't startup_failure.

Author: LarsenCundric

.github/workflows/auto-release-on-version-bump.yml

@@ -241,3 +241,4 @@ jobs:
     permissions:
       contents: read
       id-token: write   # required for OIDC publishing (cascades to the called workflow)
+      actions: read     # required for the called workflow's approval job to read the approvals API