fix(license): correct PMPL-1.0 -> MPL-2.0 SPDX headers (3 CI workflows)

typell is a sole-owner repo, so per the estate licence policy it is MPL-2.0
(PMPL-1.0 is reserved for palimpsest-license / palimpsest-plasma /
consent-aware-http only). Three CI workflow files carried PMPL-1.0 SPDX
headers; corrected to MPL-2.0. Owner-approved; per-file, not a bulk sweep.

- .github/workflows/codeql.yml
- .github/workflows/scorecard.yml
- .github/workflows/secret-scanner.yml

NOT changed (deliberately, flagged for owner):
- EXHIBIT-B-QUANTUM-SAFE.txt is a Palimpsest-MPL licence *exhibit* (its internal
  PMPL-1.0 references are correct within the licence text; its own header is
  already MPL-2.0). Whether an MPL-2.0 repo should carry it at all is an owner call.
- .machine_readable/svc/k9/examples/setup-repo.k9.ncl has a generic k9
  "add-license" EXAMPLE that curls the pmpl LICENSE -- a service example, not
  typell's own licence; the proper fix (description + curl URL) belongs at the
  k9 service source, not here.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019awZjBD1qx61tvmEuEKNpn

Author: claude

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:

.github/workflows/scorecard.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
 
 on:

.github/workflows/secret-scanner.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Secret Scanner
 
 on: