ci: pass only the secret the release workflow needs

Both reusable calls to release.yml used 'secrets: inherit', which
forwards the caller's entire secret set. The only secret release.yml
reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload
the code points blob; npm publishing is OIDC trusted publishing and
needs no token secret at all. Declare that one secret on the reusable
workflow and pass it explicitly, so the workflow files show exactly
which secret flows into the release path and nothing else does. It is
declared optional, so tag-push runs (which read it from the repo
secrets directly) and forks without the secret behave as before.

.github/workflows/ci.yml

@@ -110,14 +110,16 @@ jobs:
     if: github.repository == 'lucide-icons/lucide'
     needs: create-release
     uses: './.github/workflows/release.yml'
-    secrets: inherit
+    secrets:
+      BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
     with:
       version: ${{ needs.create-release.outputs.VERSION }}
 
   dispatch-release:
     if: github.event_name == 'workflow_dispatch'
     uses: './.github/workflows/release.yml'
-    secrets: inherit
+    secrets:
+      BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
     with:
       version: ${{ inputs.version }}
       tag: ${{ inputs.tag }}

.github/workflows/release.yml

@@ -15,6 +15,10 @@ on:
         description: NPM tag
         default: 'latest'
         type: string
+    secrets:
+      BLOB_READ_WRITE_TOKEN:
+        description: Token used by build-font to upload the code points blob
+        required: false
 
 permissions:
   id-token: write # Required for OIDC