Fix backport of workload identity & CI release scope

Backported PRs:
* elixir-lang#14604
* elixir-lang#14627

The commits are based on the SBoM PR (elixir-lang#14241) which changed the
actions.

Author: maennchen

.github/workflows/release.yml

@@ -133,6 +133,7 @@ jobs:
     permissions:
       contents: write
       id-token: write
+      attestations: write
 
     steps:
       - uses: actions/download-artifact@v4