move the required permissions for gh-pages deployment to the deploy step

Author: jakoch

.github/workflows/build-docs.yml

@@ -13,8 +13,6 @@ concurrency:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 jobs:
 
@@ -123,6 +121,12 @@ jobs:
     needs: build
     if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
 
+    # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
+    permissions:
+      contents: read
+      pages: write    # to deploy to Pages
+      id-token: write # to verify the deployment originates from an appropriate source
+
     runs-on: ubuntu-latest
 
     environment: