ci(scorecard): add explicit least-privilege job permissions

The OSSF Scorecard reusable-workflow wrapper job relied on a broad workflow-level
`read-all` and had no job-level permissions (Hypatia `scorecard_wrapper_missing_job_permissions`).
Grant the documented least-privilege set on the job (contents/actions read;
security-events/id-token write) and narrow the workflow-level grant to
`contents: read`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KfgJznd6jzSeDYsSXGAXkU

Author: claude

.github/workflows/scorecard.yml

@@ -8,9 +8,18 @@ on:
   push:
     branches: [main]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
+    # Explicit least-privilege permissions for the OSSF Scorecard reusable
+    # workflow (the documented set), instead of relying on a broad
+    # workflow-level `read-all`:
+    permissions:
+      contents: read          # read the repository
+      actions: read           # inspect workflow runs (Token-Permissions, etc.)
+      security-events: write  # upload results to the code-scanning dashboard
+      id-token: write         # OIDC, to publish results / badge
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     secrets: inherit