fix(ci): grant security-events: write to the Hypatia caller

Refreshing hypatia-scan-reusable.yml to standards HEAD turned the run into a
startup_failure — zero jobs, no log. The newer reusable declares

  permissions:
    contents: read
    security-events: write

because it uploads SARIF, while the caller granted security-events: read. A
called workflow cannot escalate beyond its caller's grant, so GitHub rejects
the whole run at parse time rather than failing a job.

This is the failure mode where refreshing a pin BREAKS a caller that was
previously fine: the old pin needed only read. Checked the other two bumped
reusables the same way — governance-reusable and scorecard-reusable both
declare only contents: read, which the callers already grant, so no change
was needed there.

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -12,7 +12,10 @@ on:
 
 permissions:
   contents: read
-  security-events: read
+  # The reusable declares security-events: write (it uploads SARIF). A called
+  # workflow cannot escalate beyond the caller's grant, so `read` here makes the
+  # whole run a startup_failure with zero jobs and no log.
+  security-events: write
 
 jobs:
   scan: