feat: Update container permissions

Author: GeekMasher

.github/workflows/container.yml

@@ -52,6 +52,10 @@ jobs:
       release: ${{ steps.set-version.outputs.release }}
       version: ${{ steps.set-version.outputs.version }}
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: "Checkout"
         uses: actions/checkout@v4
@@ -87,6 +91,11 @@ jobs:
     uses: advanced-security/reusable-workflows/.github/workflows/container-security.yml@main
     needs: set-version
     secrets: inherit
+    permissions:
+      id-token: write
+      contents: read
+      packages: read           # Read Container Registry
+      security-events: write   # Code Scanning
     with:
       version: ${{ needs.set-version.outputs.version }}
       container-file: ${{ inputs.container-file }}
@@ -98,6 +107,11 @@ jobs:
     needs: [ scan-image, set-version ]
     if: ${{ needs.set-version.outputs.release == 'true' }}
     secrets: inherit
+    permissions:
+      id-token: write
+      contents: write          # Upload SBOM to GitHub
+      packages: write          # Push to Container Registry
+      attestations: write      # Upload attestations
     with:
       version: ${{ needs.set-version.outputs.version }}
       container-file: ${{ inputs.container-file }}