github-actions: use ephemeral tokens with the right permissions

[v1v]

I somehow used the wrong permissions set in https://github.com/elastic/apm-agent-go/pull/1660

Test

I tested it in my playground, and it worked as expected