fix up permissions on publish workflow

.github/workflows/publish-osc-npm.yml

@@ -6,6 +6,7 @@ on:
 jobs:
   publish-lib:
     permissions:
+      contents: read
       id-token: write
     runs-on: ubuntu-latest
     steps:
@@ -22,6 +23,7 @@ jobs:
 
       - name: Publish to NPM
         run: npm publish --provenance --access=public --workspace @jwetzell/osc
+        
       - name: Publish to JSR
         working-directory: ./packages/osc
         run: npx jsr publish