ci: restrict the permissions

Author: Brooooooklyn

.github/workflows/CI.yml

@@ -4,9 +4,6 @@ env:
   APP_NAME: package-template
   MACOSX_DEPLOYMENT_TARGET: '10.13'
   CARGO_INCREMENTAL: '1'
-permissions:
-  contents: write
-  id-token: write
 'on':
   push:
     branches:
@@ -339,6 +336,9 @@ jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     needs:
       - lint
       - build-freebsd