ci: Add workflow-level permissions to release workflow

The earlier hardening pass skipped this file because the github-release
job already declared permissions. The validate and publish jobs still
fall back to the repository default for GITHUB_TOKEN, which is write.

Adds workflow-level `contents: read`. github-release keeps its
job-level `contents: write`; validate and publish only check out code
and publish to crates.io with CARGO_REGISTRY_TOKEN.

Claude-Session: https://claude.ai/code/session_01Rg3UBFSnmKMPQLNpNKkn8d

Author: philippemnoel

.github/workflows/release.yml

@@ -8,6 +8,9 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: Validate Release