Add missing permissions in update-helm-repo workflow

[narqo]

This is the fixup for #3366

The changes in #3366 added an explicit list of permissions, the workflow intents to use. It seems that this broke the release of Helm charts in Mimir. The "Push release tag on origin" now fails with the following:

Pushing tag mimir-distributed-5.6.0-weekly.314
remote: Permission to grafana/mimir.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/grafana/mimir/': The requested URL returned error: 403
Error: Process completed with exit code 128.

(refer to this failed build)

If I understand it right, even though we add all necessary permissions in the repo's "Workflow permissions" settings, the permissions explicitly defined in workflow's YAML override those (refer to github docs). And since the workflow doesn't list the contents: write, the action, that executes the workflow cannot push the tag. This PR fixes that.

[narqo]

Note that helm push was introduced in 3.7.0, which was release in 2021.

With 3.5.2 the workflow fails with:

The workflow fails with "Error: unknown command "push" for helm"

I propose we update to the latest release, which is 3.16, as of today.

[krajorama]

Stamp.

[narqo]

Note that we also need the repo's admin to add grafana/mimir write access to the mimir-distributed package in this repository.

Right now, with the fixes from this PR, the CI job fails when it pushes the OCI package:

helm push "/home/runner/work/mimir/mimir/.cr-release-packages/mimir-distributed-5.6.0-weekly.314.tgz" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/helm-charts"

Error: unexpected status from POST request to https://ghcr.io/v2/grafana/helm-charts/mimir-distributed/blobs/uploads/: 403 Forbidden

I've found this explanation of the problem.