Explicitly use write perms for publish step

Previously these were set for the token by default. They're now
disabled by default, and enabled only for publish pushes (tags).

Author: pimterry

.github/workflows/ci.yml

@@ -39,6 +39,8 @@ jobs:
     needs: build
     runs-on: ubuntu-22.04
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
     steps:
       - name: Get the APK
         uses: actions/download-artifact@v4