ci: grant contents:write so release asset upload doesn't 401 (#441)

The softprops/action-gh-release step falls back to GITHUB_TOKEN, which
under the org's default-read workflow policy lacks release-creation
scope. Add explicit job-level permissions so the tag-triggered run can
create the GitHub release alongside the NuGet push.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: erwan-joly

.github/workflows/dotnet.yml

@@ -10,6 +10,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
     - uses: actions/checkout@v4
     - name: Setup .NET