ci(scorecard): add job-level permissions for reusable workflow #40

Job	Run time
governance / Security policy checks	32s
governance / Well-Known (RFC 9116 + RSR)	26s
governance / Licence consistency	36s
governance / Code quality + docs	33s
governance / Workflow security linter	29s
governance / Language / package anti-pattern policy	36s
governance / Trusted-base reduction policy	39s
governance / Guix primary / Nix fallback policy	33s
governance / Validate Hypatia baseline	32s
	4m 56s

Provide feedback