Move release permissions (#5719)

* move release permissions from workflow level to job level

* use experimental version number to avoid polluting published packages

* Downgrade version from 4.38.0.experimental.1 to 4.38.0.experimental.0

* Revert "Downgrade version from 4.38.0.experimental.1 to 4.38.0.experimental.0"

This reverts commit fdf2992.

* Revert "use experimental version number to avoid polluting published packages"

This reverts commit 309d23d.

Author: jmuzina

.github/workflows/publish-on-release.yml

@@ -4,11 +4,6 @@ on:
   release:
     types: [published]
 
-# https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow
-permissions:
-  id-token: write # to enable use of OIDC for npm provenance
-  contents: read # to enable reading the contents of the release for publishing
-
 jobs:
   build:
     name: Build Vanilla
@@ -37,6 +32,10 @@ jobs:
     name: Publish to NPM
     needs: build
     runs-on: ubuntu-latest
+    # https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow
+    permissions:
+      id-token: write # to enable use of OIDC for npm provenance
+      contents: read # to enable reading the contents of the release for publishing
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6