ci: Add id-token permissions to support WIF

Grant workflow-level `id-token: write` in release.yaml and
pull_request.yaml so the jobs calling extenda/actions/* can request an
OIDC token from GitHub. The release job already re-declared it
alongside `contents: write`; job-level blocks replace rather than merge,
so that one stays as-is.

The extenda wrappers pick their auth mode from the contents of the
service-account-key value -- either a legacy `private_key` JSON key or a
`workload_identity_provider` federation config. SECRET_AUTH currently
holds a legacy key, so this permission is groundwork only. The migration
completes when SECRET_AUTH is swapped to a WIF cred-config on the GCP
side, which also needs the WIF principal to hold the Secret Manager
roles the current service account has.

The commonpom 4.0.3+ prerequisite does not apply here: this repo has no
io.extenda.maven:commonpom parent since #86, and the Maven deploy
authenticates to Maven Central with the MAVEN_CENTRAL_* and GPG secrets
rather than to GCP.

Author: thced

.github/workflows/pull_request.yaml

@@ -4,6 +4,10 @@ on:
     branches: [ master ]
     types: [ opened, synchronize, reopened ]
 
+permissions:
+  contents: read
+  id-token: write
+
 env:
   MAVEN_INIT: 'false'
 

.github/workflows/release.yaml

@@ -4,6 +4,10 @@ on:
   push:
     branches: [ master ]
 
+permissions:
+  contents: read
+  id-token: write
+
 env:
   MAVEN_INIT: 'false'