ci: normalize code-ranker stub (clean, least-privilege)

Signed-off-by: Roman Fedorov <Roman.Fedorov@constructor.tech>

Author: ffedoroff

.github/workflows/code-ranker.yml

@@ -4,9 +4,12 @@ on:
   push:
 jobs:
   code-ranker:
+    # Pinned to an immutable commit SHA (supply-chain hardening).
     uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c
     permissions:
       id-token: write
       contents: read
-      pull-requests: write
+      # No pull-requests: write here — the code-ranker GitHub App posts (and
+      # updates in place) the report comment using its own installation
+      # token, not this workflow's GITHUB_TOKEN.
       security-events: write