Add pull request and id-token write permissions to publish.yaml (#351)

This is needed in order for packages to be published.