try to fix publish workflow (#1571)

don't request PR write permissions, which the app doesn't have so it can
never work (added in #1556 with the apparent intent to tighten
permissions, but in fact expanded requested permissions beyond what was
granted to the app)

and update deprecated `app-id` to `client-id`

Author: minrk

.github/workflows/publish-changelog.yml

@@ -25,7 +25,6 @@ jobs:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write
-          permission-pull-requests: write
 
       - name: Publish changelog
         id: publish-changelog

.github/workflows/publish-release.yml

@@ -13,7 +13,7 @@ on:
         required: false
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   publish_release:
@@ -27,10 +27,9 @@ jobs:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
-          app-id: ${{ vars.APP_ID }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write
-          permission-pull-requests: write
 
       - name: Populate Release
         id: populate-release