fix(ci): give publish workflow required permissions

Author: joanise

.github/workflows/pythonpublish.yml

@@ -25,6 +25,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     needs: tests
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v5
         with:
@@ -89,11 +91,13 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - github-release
+    permissions:
+      contents: write  # to deploy to gh-pages
     steps:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0 # fetch all commits/branches
-          persist-credentials: false
+          persist-credentials: true  # so we can deploy to gh-pages
       - name: Set up Python
         uses: actions/setup-python@v6
         with: