[DEVOPS-4311] ci: add missing contents read permission

[Richard Boisvert (rbstp)]

Summary

• Add missing contents: read permission to onedrive-gateway and onedrive-agent jobs
• When permissions is specified at job level, it overrides all defaults including contents: read, causing actions/checkout to fail with "Repository not found"
• Fix for regression introduced in ci: add provenance attestations #1713

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries