fix(ci): grant the secret-scanner reusable its required job permissions

The `scan` job calls secret-scanner-reusable.yml, whose `gitleaks` job
declares `pull-requests: write` (PR summary comment) and `actions: read`
(workflow-run metadata) at job level. A called reusable workflow may only
request permissions equal to or more restrictive than its caller. This
caller granted only the file-level `contents: read`, so GitHub refused the
run at parse time and every Secret Scanner run ended in `startup_failure` —
secret scanning has not actually executed in this repo since the pin landed.

Grants the superset at job level, matching the canonical template and the
176 estate repos whose scanner already runs. No SHA pin is changed.

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -15,5 +15,12 @@ permissions:
 
 jobs:
   scan:
+    # The reusable's gitleaks job requests pull-requests: write (PR summary
+    # comment) and actions: read (workflow-run metadata) at job level; the
+    # caller must grant at least that or the run startup-fails.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit