fix(scorecard): drop branch_protection_rule trigger + add workflow_dispatch

Working hypothesis on persistent startup_failure: the
`branch_protection_rule:` trigger may be the parse-time rejection
cause (no repo-level branch protection rule resource → parse error
during workflow ingestion). Dropping it as the next test.

Adding `workflow_dispatch:` so a manual trigger is available for
debugging without committing.

Previous attempt (fc7abf5): scoped permissions to contents:read —
no effect on startup_failure. Reverting that change of permissions
would be ergonomically counter-canonical, so leaving as-is.

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -2,11 +2,11 @@
 name: Scorecards supply-chain security
 
 on:
-  branch_protection_rule:
   schedule:
     - cron: '23 4 * * 1'
   push:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read