fix: add permissions to release-please job, not provenance job

Co-Authored-By: rlamb@launchdarkly.com <kingdewman@gmail.com>

Author: devin-ai-integration[bot]

.github/workflows/release-please.yml

@@ -7,6 +7,9 @@ name: release-please
 jobs:
   release-please:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+      pull-requests: write
     outputs:
       package-client-released: ${{ steps.release.outputs['libs/client-sdk--release_created'] }}
       package-client-tag: ${{ steps.release.outputs['libs/client-sdk--tag_name'] }}
@@ -165,7 +168,6 @@ jobs:
       actions: read
       id-token: write
       contents: write
-      pull-requests: write
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
     with:
       base64-subjects: "${{ needs.release-client.outputs[format('hashes-{0}', matrix.os)] }}"