ci: use explicit and per job permissions (#3002)

* ci: use explicit and per job permissions

* update CHANGELOG

.github/workflows/web-deploy.yml

@@ -12,8 +12,6 @@ on:
 # Sets the GITHUB_TOKEN permissions to allow deployment to GitHub Pages
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # Allow one concurrent deployment
 concurrency:
@@ -105,6 +103,9 @@ jobs:
 
   deploy:
     name: Deploy site to GitHub Pages
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}