fix(github): add missing contents: read permission to publish workflows (#4485)

The `_setup.yml` reusable workflow requires `contents: read`, but the
publish workflows only declared `id-token: write`, which implicitly set
all other permissions to `none`.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: pomfrida

.github/workflows/publish_core_react.yaml

@@ -20,6 +20,7 @@ on:
           - production
         default: 'development'
 permissions:
+  contents: read
   id-token: write
 env:
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

.github/workflows/publish_storybook.yaml

@@ -18,6 +18,7 @@ on:
       - 'packages/eds-tokens/**'
       - 'packages/eds-icons/**'
 permissions:
+  contents: read
   id-token: write
 env:
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}