ci: specify workflow permissions per job

Also remove some unnecessary permissions:

* The notification job in release-artifacts.yml only needs to read repo
  contents, not write contents and actions.
* All jobs in release.yml except "Create release" and "Update podman.io"
  only need to read repo contents. "Update podman.io" only needs to
  write repo contents and pull requests.
* Likewise, permissions for update-podmanio.yml can be restricted to
  only writing repo contents and pull requests.

Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>