fix: broaden version regex and add build job least-privilege permissions

- Fix regex to correctly accept rc, .dev, and .post PEP 440 forms
- Add permissions: contents: read to the build job

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: adityamehra

.github/workflows/release-splunk-ao-a2a.yaml

@@ -4,14 +4,16 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version to release (e.g., 0.1.0, 1.2.3). Must be an explicit PEP 440 version — bump keywords like "patch" or "minor" are not accepted.'
+        description: 'Version to release (e.g., 0.1.0, 1.2.3, 1.2.3rc1, 1.2.3.post1). Must be an explicit version — bump keywords like "patch" or "minor" are not accepted.'
         required: true
         type: string
 
 jobs:
   build:
     name: Build package
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: splunk-ao-a2a
@@ -29,8 +31,8 @@ jobs:
         env:
           INPUT_VERSION: ${{ inputs.version }}
         run: |
-          if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([abprc.][0-9]+)*$'; then
-            echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit PEP 440 version (e.g. 0.1.0, 1.2.3b1). Bump keywords like 'patch' or 'major' are not accepted."
+          if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then
+            echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
             exit 1
           fi
           sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml