ci: scope prepare release workflow permissions

[kitsuyui]

Summary

• Remove workflow-level write permissions from the release update preparation workflow.
• Give the read-only resolve and validate jobs contents: read only.
• Keep contents: write and pull-requests: write scoped to the job that opens the update pull request.

Verification

• git diff --check
• actionlint
• shfmt -d scripts/*.sh
• shellcheck scripts/*.sh
• typos
• workflow permissions YAML assertion
• collateral check: clean