fix(release): scope the tap token to contents write

Without a permission-* input, actions/create-github-app-token mints a token
carrying every permission the App installation holds -- here that includes
pull-request write, which cloning and pushing the Homebrew tap never uses.
Supplying one input switches the action to strict opt-in, so the token now
carries contents write and nothing else.

Author: elkaix

.github/workflows/release.yml

@@ -325,6 +325,9 @@ jobs:
         with:
           node-version-file: .nvmrc
 
+      # Any permission-* input switches the token from inheriting every
+      # permission the App installation holds to exactly the ones listed here.
+      # Cloning and pushing the tap needs contents and nothing else.
       - name: Mint tap token
         id: tap-token
         uses: actions/create-github-app-token@v2
@@ -333,6 +336,7 @@ jobs:
           private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
           owner: PyModel
           repositories: homebrew-tap
+          permission-contents: write
 
       - name: Bump formula
         env: