Fix backport of workload identity & CI release scope (#14745)

Backported PRs:
* #14604
* #14627

The commits are based on the SBoM PR (#14241) which changed the
actions.

Author: maennchen

.github/workflows/release.yml

@@ -133,6 +133,7 @@ jobs:
     permissions:
       contents: write
       id-token: write
+      attestations: write
 
     steps:
       - uses: actions/download-artifact@v4