.github/workflows: downscope permissions where possible

.github/workflows/build.yml

@@ -1,12 +1,14 @@
+name: Build and upload binaries
 on:
   release:
     types: [published]
   push:
   pull_request:
-name: Build binaries
+permissions:
+  contents: read
 jobs:
-  binaries:
-    name: Build and upload
+  build:
+    name: Build binaries
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
@@ -47,9 +49,20 @@ jobs:
         with:
           name: age-binaries
           path: age-*
+  upload:
+    name: Upload release binaries
+    if: ${{ github.event_name == 'release' }}
+    needs: build
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download workflow artifacts
+        uses: actions/download-artifact@v2
+        with:
+          name: age-binaries
       - name: Upload release artifacts
         uses: actions/github-script@v3
-        if: ${{ github.event_name == 'release' }}
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |