fix(ci): grant security-fix job permissions in on-main workflow (#2094)

The top-level 'permissions: contents: read' in on-main.yml was capping the permissions requested by the reusable _security-fix-agent.yml workflow, causing the workflow file to be rejected as invalid on merges to main:

  The nested job 'remediate' is requesting
  'contents: write, issues: write, pull-requests: write, id-token: write',
  but is only allowed 'contents: read, issues: none, pull-requests: none, id-token: none'.

Grant the elevated permissions explicitly on the 'security-fix' job so the called workflow can run, while keeping the restrictive defaults for every other job.

Author: samuv

.github/workflows/on-main.yml

@@ -30,4 +30,9 @@ jobs:
     needs: security
     if: ${{ always() && needs.security.result == 'failure' }}
     uses: ./.github/workflows/_security-fix-agent.yml
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
     secrets: inherit