fix(release): give enough permissions to tag

.github/workflows/tag.yaml

diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index f88fe88..96a65e0 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -24,7 +24,7 @@
       new-tag: ${{ steps.ccv.outputs.new-tag }}
       new-tag-version: ${{steps.ccv.outputs.new-tag-version}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           # Need enough history to find the prior release tag
           fetch-depth: 0
@@ -39,3 +39,5 @@
     if: needs.tag.outputs.new-tag == 'true' && needs.tag.outputs.new-tag-version-type != 'major'
     permissions:
       contents: write # allow create release
+      attestations: write
+      id-token: write