Revert "Switch to permissions for auto-release workflow (#4163)"

[itzg]

Reverts #4163 and adds docs so I won't do it again

By default, actions executed using the standard repository token (GITHUB_TOKEN) cannot trigger other workflow runs. If your auto-release workflow creates a release or pushes a tag using the implicit GITHUB_TOKEN, GitHub explicitly drops any subsequent webhook events (like a push to a tag) that would normally trigger other actions.