security(ci): reduce bot privileges

Merge pull request #185 from squat/dependabot/docker/nixos/nix-2.34.4

Merge pull request #186 from squat/dependabot/github_actions/DeterminateSystems/determinate-nix-action-3.17.1

build(deps): bump DeterminateSystems/determinate-nix-action

build(deps): bump nixos/nix from 2.34.2 to 2.34.4

Merge pull request #184 from squat/update_flake_lock_action

flake.lock: Update

Merge pull request #183 from squat/no_latest_tags_if_not_on_main

fix(CI): don't push latest tag if not on main

Merge pull request #181 from squat/enable_git_tags_on_containers

feat(CI): enable tagging containers with Git tags

Merge pull request #179 from squat/dependabot/go_modules/k8s.io/kubelet-0.35.3

Merge pull request #180 from squat/dependabot/docker/nixos/nix-2.34.2

build(deps): bump nixos/nix from 2.34.1 to 2.34.2

build(deps): bump k8s.io/kubelet from 0.35.2 to 0.35.3