Reduce CI release-token exposure in build jobs

[Lightbrother0707]

Summary

This changes the release binary upload flow so the platform build jobs only need contents: read. The contents: write permission is moved into a small tag-only release-binaries job that downloads the generated release zip artifacts and uploads them to the GitHub release.

Security benefit

build-linux, build-windows, build-mac-intel, and build-mac-universal currently run build and test commands across multiple event types, while also granting contents: write for release uploads. Only the tag-release upload needs write access to repository contents.

This patch reduces the exposure window for the workflow token by keeping ordinary build/test jobs read-only and limiting write access to a dedicated job that only runs for tag refs.

Release behavior

The existing zip file names and digest generation are preserved:

• Linux.flatc.binary.${{ matrix.cxx }}.zip
• Windows.flatc.binary.zip
• MacIntel.flatc.binary.zip
• Mac.flatc.binary.zip

The build jobs upload those zip files as workflow artifacts on tag builds. The new release-binaries job downloads the release-* artifacts and uploads the collected zip files with softprops/action-gh-release.

Testing

I reviewed the workflow structure manually. I could not run the release workflow end-to-end because it requires a tag/release context and repository secrets.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.