ci: allow GITHUB_TOKEN to push OCI image & create a release

Signed-off-by: Husen <hi@husen.id>

.github/workflows/main.yml

@@ -54,6 +54,8 @@ jobs:
     needs: pretest
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
 
     steps:
       - name: Checkout
@@ -138,9 +140,11 @@ jobs:
 
   release:
     name: Release
-    runs-on: ubuntu-latest
     needs: test
     if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout