Publish job needs contents:read alongside id-token:write

Setting permissions on the job replaces the defaults, so checkout lost
repository read access and failed on the private repo.

Author: Anirudha2604

.github/workflows/publish.yml

@@ -22,6 +22,7 @@ jobs:
     environment: pypi
     permissions:
       id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5