fix(ci): grant the reusable workflow the permissions it needs

[Taure]

What

Adds the permissions: block the reusable Taure/erlang-ci workflow needs.

Why

Runs were failing with startup_failure - no jobs, no logs. The calling job
inherited the repository default GITHUB_TOKEN permission, which is read.
The called workflow needs more:

• release.yml -> the release job requires contents: write
• ci.yml -> dependency-submission requires contents: write, and summary
  requires pull-requests: write (enable-summary defaults to true, so this
  bites even when it was never opted into)

A reusable workflow cannot request more than its caller grants, so GitHub rejects
the run while building the job graph, before any job exists. That is why there
was nothing to read in the logs.

Taure/kura and the other green repos already carry this block; these did not.

Affects release.yml. This repo's ci.yml already had the block, which is why
CI was green and only Release failed.

[github-actions]

🟡 Code Coverage — 78%

284 of 364 lines covered.

---

ℹ️ 38 OTP CVEs auto-ignored (already fixed in running version)

These CVEs are patched in the installed OTP version but NVD data
has not been updated to reflect this. They are excluded from the
scan via an auto-generated .trivyignore.

CVE	Details
CVE-2026-54890	Fixed in 28.5.0.4, running 28.5.0.5 — binary_to_term crash on crafted BIT_BINARY_EXT input
CVE-2026-59251	Fixed in 28.5.0.4, running 28.5.0.5 — Denial of Service via Exponential Certificate Policy Tree Growth
CVE-2026-58227	Fixed in 28.5.0.4, running 28.5.0.5 — TLS Denial-of-Service using Invalid Cert Chains
CVE-2026-59250	Fixed in 28.5.0.4, running 28.5.0.5 — Megaco Flex Scanner Buffer Overflow via Oversized Property Parm Name
CVE-2026-55953	Fixed in 28.5.0.4, running 28.5.0.5 — (D)TLS-1.2 Server Cert Verification Bypass via Unoffered Anonymous Cipher Suite
CVE-2026-55952	Fixed in 28.5.0.3, running 28.5.0.5 — Denial-of-Service for TLS-1.3 server Using Session Tickets
CVE-2026-55950	Fixed in 28.5.0.3, running 28.5.0.5 — DTLS Denial of Service
CVE-2026-54891	Fixed in 28.5.0.3, running 28.5.0.5 — Plaintext Injection Towards (D)TLS Client During Handshake
CVE-2026-54886	Fixed in 28.5.0.3, running 28.5.0.5 — SSH SFTP server denial of service via extended data infinite loop
CVE-2026-54887	Fixed in 28.5.0.3, running 28.5.0.5 — DTLS Cookie Bypass During Startup
CVE-2026-55737	Fixed in 28.5.0.4, running 28.5.0.5 — Heap Pointer Corruption via signed/unsigned Mismatch in LARGE_TUPLE_EXT Decoding (binary_to_term/1)
CVE-2026-53422	Fixed in 28.5.0.3, running 28.5.0.5 — OTP ssh_sftpd REALPATH Path Existence Oracle ( File system Enumeration )
CVE-2026-49760	Fixed in 28.5.0.2, running 28.5.0.5 — Stack Buffer Overflow in ei_s_print_term at Very Large Integer
CVE-2026-49759	Fixed in 28.5.0.2, running 28.5.0.5 — Unbounded Stack Buffer Overflow in SCTP Error Cause Parsing in inet_drv
CVE-2026-48858	Fixed in 28.5.0.2, running 28.5.0.5 — FTP Client PASV Response IP not Validated Against Control Peer, Enabling SSRF and FTP Bounce Attacks
CVE-2026-48860	Fixed in 28.5.0.2, running 28.5.0.5 — Distribution-over-TLS LAN Allowlist is Silently Bypassed
CVE-2026-48856	Fixed in 28.5.0.2, running 28.5.0.5 — httpc leaks Authorization header to cross-origin redirect targets
CVE-2026-48855	Fixed in 28.5.0.2, running 28.5.0.5 — SFTP READLINK response leaks absolute backend filesystem path when root is configured
CVE-2026-47078	Fixed in 28.5.0.4, running 28.5.0.5 — Relative path traversal in zip:unzip via check_dir_level depth-counter bypass
CVE-2026-42792	Fixed in 28.5.0.4, running 28.5.0.5 — epmd: Denial-of-service via accept(EMFILE)
CVE-2026-42790	Fixed in 28.5.0.1, running 28.5.0.5 — Name Constraints and Subject CommonName Fallback in TLS hostname Verification
CVE-2026-42789	Fixed in 28.5.0.1, running 28.5.0.5 — public_key Accepts non-CA Certificate as Intermediate Issuer, Enabling Chain Forgery
CVE-2026-42791	Fixed in 28.5.0.1, running 28.5.0.5 — OCSP Responder Certificate Accepted After Expiry in public_key
CVE-2026-32147	Fixed in 28.4.3, running 28.5.0.5 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot
CVE-2026-28808	Fixed in 28.4.2, running 28.5.0.5 — ScriptAlias CGI targets bypass directory auth (mod_auth vs mod_cgi path mismatch)
CVE-2026-32144	Fixed in 28.4.2, running 28.5.0.5 — OCSP designated-responder authorization bypass — missing signature verification (RFC 6960 §4.2.2.2)
CVE-2026-28810	Fixed in 28.4.2, running 28.5.0.5 — Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver
CVE-2026-23943	Fixed in 28.4.1, running 28.5.0.5 — Pre-auth SSH DoS via unbounded zlib inflate
CVE-2026-23942	Fixed in 28.4.1, running 28.5.0.5 — SFTP root escape via component-agnostic prefix check in ssh_sftpd
CVE-2026-23941	Fixed in 28.4.1, running 28.5.0.5 — Request smuggling via first-wins Content-Length parsing in inets httpd
CVE-2026-21620	Fixed in 28.3.2, running 28.5.0.5 — TFTP Path Traversal
CVE-2016-1000107	Fixed in 28.0.4, running 28.5.0.5 — Httpd CGI Scripts Environment Variable Pollution AKA "httpoxy"
CVE-2025-58050	Fixed in 28.0.3, running 28.5.0.5 — Buffer Read Overflow on Regular Expressions with (*scs:) and (*ACCEPT)
CVE-2025-48038	Fixed in 28.0.3, running 28.5.0.5 — SSH Unverified File Handles can Cause Excessive Use of System Resources
CVE-2025-48039	Fixed in 28.0.3, running 28.5.0.5 — SSH Unverified Paths can Cause Excessive Use of System Resources
CVE-2025-48040	Fixed in 28.0.3, running 28.5.0.5 — SSH Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
CVE-2025-48041	Fixed in 28.0.3, running 28.5.0.5 — SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
CVE-2025-4748	Fixed in 28.0.1, running 28.5.0.5 — Absolute Path in Zip Module