v2.6.5

Bug Fixes

• move workflow permissions to job level (1ea64e0)
• prevent script injection in tag-on-merge workflow (85fb85d)
• reduce pull-request-lint permissions to read-only (8d53c56)
• remove dangerous workflow patterns (1f20363)
• remove unnecessary actions:write permission from create-release (fd3401a)