Scope cultivator token to contents and pull-requests (#478)

.github/workflows/release-plz.yml

@@ -22,11 +22,15 @@ jobs:
       with:
         egress-policy: audit
     - name: generate cultivator token
-      uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       id: generate-token
       with:
         app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
         private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+        # Scope to what release-plz needs: push the release branch and create
+        # tags/releases (contents), open/update the release PR (pull-requests).
+        permission-contents: write
+        permission-pull-requests: write
     - name: checkout repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with: