What grants should I give to allow `COPY ... TO STDOUT`?
The replication user needs to read the tables:
GRANT SELECT ON table1, table2, ... TO replication;

This must of course be run on the logical replication primary server.