More permission tweaking.

* pr_test_cache.yml: actions: write should not be necessary outside of
  clean_cache, which already specifies that. Drop it at the workflow
  level.
* publish_docker_images.yml: move write permissions from workflow level
  to job level.

Author: hvdijk

.github/workflows/pr_tests_cache.yml

@@ -27,9 +27,6 @@ env:
 concurrency:
   group: pr-test-cache-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
-
-permissions:
-  actions: write
 jobs:
   ubuntu_22_llvm_prev_jobs:
     if: github.repository == 'uxlfoundation/oneapi-construction-kit' || github.event_name != 'schedule'
@@ -167,7 +164,7 @@ jobs:
     needs: [ubuntu_22_llvm_current_aarch64_jobs, windows_llvm_current_jobs]
     runs-on: ubuntu-latest
     permissions:
-      actions: write
+      actions: write # for gh cache delete
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4

.github/workflows/publish_docker_images.yml

@@ -10,9 +10,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 env:
   REGISTRY: ghcr.io/uxlfoundation
@@ -21,6 +18,10 @@ jobs:
 
   publish-docker-images-x86-64:
     runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      id-token: write
+      packages: write
     steps:
     - name: Checkout
       uses: actions/checkout@v4
@@ -40,6 +41,10 @@ jobs:
 
   publish-docker-images-aarch64:
     runs-on: ubuntu-22.04-arm
+    permissions:
+      attestations: write
+      id-token: write
+      packages: write
     steps:
     - name: Checkout
       uses: actions/checkout@v4