Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[infiloop2]

Potential fix for https://github.com/smartcontractkit/cre-cli/security/code-scanning/2

In general, the fix is to explicitly scope the GITHUB_TOKEN permissions for the release job so it follows the principle of least privilege. Since this job creates a release and uploads assets, it needs write access to repository contents; read access is implied by write, so contents: write is sufficient.

Concretely, in .github/workflows/build-and-release.yml, under the release job definition (around line 404), add a permissions section specifying contents: write. This mirrors the existing pattern used in the other jobs (which specify id-token: write and contents: read) while granting only the capability actually needed for creating and updating releases. No other functionality or steps need to change; we’re just clarifying and constraining the token’s scope.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.