[bug] Broken workflow permissions

[funnelfiasco]

The workflow permission changes I made in #2276 probably include some overly-restricted permissions that will cause the workflow to fail. guac-visualizer has similar changes, so once we get those ironed out, I'll fix them here as well.

[funnelfiasco]

Reopening because, looking at the release workflow history, it has failed with "Startup failure" since #2276 was merged. I can't see any indication why.

[pxp928]

Error reported:

The workflow is not valid. .github/workflows/release.yaml (Line: 174, Col: 3): Error calling workflow 'slsa-framework/slsa-github-generator/.github/workflows/[email protected]'. The workflow is requesting 'contents: read', but is only allowed 'contents: none'. .github/workflows/release.yaml (Line: 174, Col: 3): Error calling workflow 'slsa-framework/slsa-github-generator/.github/workflows/[email protected]'. The nested job 'detect-env' is requesting 'id-token: write', but is only allowed 'id-token: none'.

[funnelfiasco]

#2341 should fix this