ci: add missing permissions to release and schedule

.github/workflows/release.yaml

@@ -18,7 +18,7 @@ jobs:
       packages: write
       pull-requests: none
       repository-projects: none
-      security-events: none
+      security-events: write # needed to write sarif to security tab
       statuses: none
       id-token: write # needed for signing the images with GitHub OIDC using cosign
     steps:

.github/workflows/schedule.yaml

@@ -10,6 +10,19 @@ jobs:
   scan-backend:
     name: Scan backend image
     runs-on: ubuntu-latest
+    permissions:
+      actions: none
+      checks: none
+      contents: none
+      deployments: none
+      issues: none
+      packages: write
+      pull-requests: none
+      repository-projects: none
+      security-events: write
+      statuses: none
+      # needed for `cosign attest`
+      id-token: write
     steps:
       - uses: adfinis/[email protected]
         with: