[ci] grants write permission to create branch in remote (#11269)

The branch release workflow failed with

```
Parsing package "packages/packages/go_router"...
  Creating new branch "go_router-23134404669-1"...
  Pushing branch go_router-23134404669-1 to remote origin...
Unhandled exception:
ProcessException: remote: Permission to flutter/packages.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/flutter/packages/': The requested URL returned error: 403
  Command: git push origin go_router-23134404669-1
```

https://github.com/flutter/packages/actions/runs/23134404669/job/67194648551

## Pre-Review Checklist

**Note**: The Flutter team is currently trialing the use of [Gemini Code Assist for GitHub](https://developers.google.com/gemini-code-assist/docs/review-github-code). Comments from the `gemini-code-assist` bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

[^1]: Regular contributors who have demonstrated familiarity with the repository guidelines only need to comment if the PR is not auto-exempted by repo tooling.

.github/workflows/batch_release_pr.yml

diff --git a/.github/workflows/batch_release_pr.yml b/.github/workflows/batch_release_pr.yml
index 12e0278..43d8456 100644
--- a/.github/workflows/batch_release_pr.yml
+++ b/.github/workflows/batch_release_pr.yml
@@ -5,10 +5,14 @@
     types: [batch-release-pr]
 
 jobs:
-  create_release_pr:
+  create_batch_release_branch:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Grants write permission to create a branch.
     env:
       BRANCH_NAME: ${{ github.event.client_payload.package }}-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      branch_created: ${{ steps.check-branch-exists.outputs.exists }}
     steps:
       - name: checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
@@ -36,8 +40,20 @@
             echo "exists=false" >> $GITHUB_OUTPUT
           fi
 
+  create_release_pr:
+    needs: create_batch_release_branch
+    if: needs.create_batch_release_branch.outputs.branch_created == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write # Grants write permission to create a PR.
+    env:
+      BRANCH_NAME: ${{ github.event.client_payload.package }}-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          ref: ${{ env.BRANCH_NAME }}
       - name: Create batch release PR
-        if: steps.check-branch-exists.outputs.exists == 'true'
         uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}