Allow OIDC token exchange in Publish workflow for pull_request_target

[Copilot]

Summary

Publishing began failing after moving to pull_request_target because NuGet/login@v1 could not exchange an OIDC token. This change aligns the workflow permissions with NuGet trusted publishing requirements.

Added

• Added workflow-level id-token: write to .github/workflows/publish.yml so OIDC token issuance is allowed for publishing.

Changed

• Publish workflow permissions
  • Extended the existing top-level permissions block to include OIDC token permission.
• Snippet

  permissions:
    contents: write
    packages: write
    id-token: write

Fixed

• Fixed NuGet trusted publishing failure on pull_request_target (The GitHub Actions event 'pull_request_target' is not allowed) by enabling the required OIDC permission scope.

Removed

• None.

Security

• Keeps NuGet authentication on short-lived OIDC credentials while preserving existing repository/package permission scopes.

Deprecated

• None.