BUG - Update release workflow permissions

[trallard]

This is a follow-up to #2077. This PR fixes action permissions to call reusable workflows in our release workflow.

I also pinned the SHA for a workflow I missed in a previous review.

[trallard]

This is ready for review. Ignore the odd a11y-tests "required" workflow.
See #2164

[drammock]

strange linkcheck failure here:
https://github.com/pydata/pydata-sphinx-theme/actions/runs/13813331844/job/38640040791?pr=2162#step:4:52

it's an actual ERROR on the kitchen sink page, in among the usual WARNINGs. I can reproduce locally on both docs-linkcheck and docs-dev. It appears to be choking on these lines?

https://github.com/python/cpython/blob/65b58291b0c0e7d87383514f62dea4d875f76950/Lib/urllib/parse.py#L886-L890

Which have been in the docstring of urllib.parse.quote for ~6 years.

Locally if I change the tox runner to use Py3.13 instead of 3.12 everywhere, the error goes away 🤷🏻 I had the idea to try that because that docstring is not shown in the official Python docs for that function:

https://docs.python.org/3/library/urllib.parse.html#urllib.parse.quote

although that docstring must be coming from elsewhere since the relevant lines are still there in cPython main

in any event, since it's a bit out of our control to fix, I'll go ahead and merge without linkcheck success.

[trallard]

gaaaaaah!

Locally if I change the tox runner to use Py3.13 instead of 3.12 everywhere, the error goes away 🤷🏻 I had the idea to try that because that docstring is not shown in the official Python docs for that function:

Idea 💡 use Python 3.13 for the linkcheck workflow

[drammock]

Idea 💡 use Python 3.13 for the linkcheck workflow

IIUC, I think it needs to be set for docs-no-check too because linkcheck depends on that