use separate job with specific permissions for coverage report

.github/workflows/go.yml

@@ -29,6 +29,13 @@ jobs:
         run: go build -v ./...
       - name: Test
         run: make test
+  coverage:
+    name: coverage
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
       - name: Update coverage report
         uses: ncruces/go-coverage-report@v0
         with: