Add write to packages/attestations for ghcr.io packages

Author: mallardduck

.github/workflows/head-build.yml

@@ -39,6 +39,8 @@ jobs:
       # - Read vault secrets in rancher-eio/read-vault-secrets.
       # - Publish image to ghcr.io
       id-token: write
+      packages: write
+      attestations: write
 
     runs-on: ubuntu-latest
     needs:

.github/workflows/release-publish.yml

@@ -27,6 +27,8 @@ jobs:
       # - OIDC for cosign's use in ecm-distro-tools/publish-image.
       # - Read vault secrets in rancher-eio/read-vault-secrets.
       id-token: write
+      packages: write
+      attestations: write
 
     runs-on: ubuntu-latest