fix perms in publish workflow

[drammock]

@Carreau and @trallard the PyPI publish workflow is broken again, this time by the new coverage action. The Coverage step inside tests.yml needs contents: write, pull-requests: write permissions. That means we need to grant those permissions to the entire tests workflow when that workflow is called from within another action (in this case, the publish.yml action).

This PR will do that (as a quick-fix to allow us to get the release out) and I'll self-merge this if necessary later today, to facilitate a timely release. But IMO a better solution is to separate the test and coverage actions into separate workflows, so that:

• on PRs, test and coverage get run
• when releases are tagged, test and publish get run (but not coverage)

WDYT?

[drammock]

I should be explicit, I guess: my motivation for splitting them is so that we can keep permissions as low as possible for each action / step. Putting coverage into its own workflow means only coverage gets PR write permissions.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[drammock]

argh, I'm gonna revert this. Even with the right permissions the Coverage step fails when called from the release job because (of course) there is no pull request for it to post its comment to. So it still blocks the release upload.

[Carreau]

sorry about that. Github actions are complicated.