ci: potential fix for code scanning alert no. 2: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: shijistar

.github/workflows/npm-publish.yml

@@ -4,6 +4,12 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: write
+  packages: write
+  actions: read
+  statuses: write
+
 jobs:
   test:
     uses: ./.github/workflows/reusable-test.yml