Extend permissions to make update-pr work

This is an attempt to also have update-pr use a personal-access token -
the build-bottle jobs use the very same steps to access secretsmanager
and seem to be able to use the resulting token.

.github/workflows/release-brew.yaml

@@ -155,6 +155,7 @@ jobs:
  runs-on: macos-latest
  permissions:
  id-token: write
+ contents: write
  steps:
  - uses: actions/download-artifact@v4
  with: