chore(NODE-5474): move id-token permission to workflow (#3778)

Author: nbbeeken

.github/workflows/release-4.x.yml

@@ -6,14 +6,13 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 name: release-4x
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
     steps:
       - id: release
         uses: google-github-actions/release-please-action@v3

.github/workflows/release-alpha.yml

@@ -8,13 +8,14 @@ on:
         required: true
         type: string
 
+permissions:
+  id-token: write
+
 name: release-alpha
 
 jobs:
   release-alpha:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
     steps:
       - shell: bash
         run: |

.github/workflows/release-nightly.yml

@@ -11,13 +11,14 @@ on:
   # As long as the commit hash has changed on main a release will be published
   workflow_dispatch: {}
 
+permissions:
+  id-token: write
+
 name: release-nightly
 
 jobs:
   release-nightly:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
     steps:
       - uses: actions/checkout@v3
       - name: actions/setup

.github/workflows/release.yml

@@ -6,14 +6,13 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 name: release
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
     steps:
       - id: release
         uses: google-github-actions/release-please-action@v3