Explicitly give GHCR perms to deploy step only

The previous deploy failed as we've tightened up default GH
permissions to ensure most jobs can't write or publish anything by
default.

Author: pimterry

.github/workflows/ci.yml

@@ -21,6 +21,9 @@ jobs:
     environment: production
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write # Required to publish containers to GHCR
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v2