chore(license): restore MPL-2.0 SPDX in scorecard/secret-scanner (merge regression)

Taking main's versions of these two workflows during the #77 reconciliation re-introduced
PMPL-1.0 SPDX headers (main's estate-standardization never fixed them). Restore MPL-2.0 to
match the repo-wide standard.

https://claude.ai/code/session_013wg3Mtq2QFhYi4XVw1Z6z7

Author: claude

.github/workflows/scorecard.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
 on:
   branch_protection_rule:

.github/workflows/secret-scanner.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Secret Scanner
 on:
   pull_request: