Move id-token permission

[brynary]

This can be specified at the job level

[qltysh]

Diff Coverage: Not applicable. There was no coverage data reported for the files in this diff.

Total Coverage: This PR will not change total coverage.

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[Copilot]

Pull Request Overview

This PR moves the id-token permission from the global workflow level to the specific build job, limiting its scope.

• Removed id-token: write from the top-level permissions
• Added permissions: id-token: write under the build job