Chore: Resolves some zizmor reported code scan findings (#12516)

Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>

.github/workflows/ci-docs.yml

@@ -10,8 +10,6 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
-  pages: write
-  id-token: write
 env:
   DEFAULT_UV_VERSION: "0.10.x"
   DEFAULT_PYTHON_VERSION: "3.12"
@@ -105,6 +103,9 @@ jobs:
     needs: [changes, build]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.docs_changed == 'true'
     runs-on: ubuntu-24.04
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}