CHANGELOG.md has wrong file permissions in the released .tar.gz #5305

What happened:

CHANGELOG.md has wrong file permissions (not readable by group/others).

$ tar -tvf syft_1.52.0_linux_amd64.tar.gz
-rw------- runner/runner  5707 2026-09-17 16:32 CHANGELOG.md
-rw-r--r-- runner/runner 11357 2026-09-17 16:31 LICENSE
-rw-r--r-- runner/runner  6171 2026-09-17 16:31 README.md
-rwxr-xr-x runner/runner 87421090 2026-09-17 16:09 syft

What you expected to happen:

CHANGELOG.md should have the same file permissions as LICENSE and README.md

Steps to reproduce the issue:

Download the file syft_1.52.0_linux_amd64.tar.gz from GitHub releases (https://github.com/anchore/syft/releases#release-v1.52.0) and inspect the file: tar -tvf syft_1.52.0_linux_amd64.tar.gz

Anything else we need to know?:

Environment:

• Output of syft version: syft 1.52.0
• OS (e.g: cat /etc/os-release or similar): Linux