fix(ci): grant security-fix job permissions in scheduled workflow

[samuv]

Summary

• Fix `Invalid workflow file` error on the scheduled security run caused by the top-level `permissions: contents: read` in `security-fix-cron.yml` capping the permissions of the reusable `_security-fix-agent.yml` workflow.
• Grant the required permissions (`contents: write`, `pull-requests: write`, `issues: write`, `id-token: write`) explicitly on the `security-fix` job — same pattern already used in `on-main.yml` (fix(ci): grant security-fix job permissions in on-main workflow #2094).
• The `security` job continues to inherit the safer `contents: read` default.

The failing workflow error was:

The nested job 'remediate' is requesting 'contents: write, issues: write, pull-requests: write, id-token: write', but is only allowed 'contents: read,

[Copilot]

Pull request overview

Fixes the scheduled “Security Fix” GitHub Actions workflow failing with Invalid workflow file by ensuring the security-fix job has sufficient permissions when invoking the reusable _security-fix-agent.yml workflow (matching the established pattern in on-main.yml).

Changes:

• Adds explicit job-level permissions (contents, pull-requests, issues, id-token: write) to the scheduled security-fix job.
• Keeps the workflow’s top-level default permission at contents: read so the security job remains least-privileged.