fix: updates instructions for private repositories in pdm publish.

[rentruewang]

Pull Request Checklist

• A news fragment is added in news/ describing what is new.
• Test cases added for changed code.

Describe what you have changed in this PR.

I have updated docs s.t. the github actions workflow example in the Build and Publish page would work for private repositories.

The reason it would previously not work is because settings of

permissions:
      id-token: write

would overwrite the default which is

permissions:
      contents: read

which results in a checkout fail.

See: actions/checkout#254 (not the issue itself, but the explanation here actions/checkout#254 (comment))