fix(ci): grant wrappers the permission union their reusables demand

At standards >= fcb8669 the governance/hypatia/mirror/scorecard
reusables declare actions: read (hypatia adds security-events: write;
scorecard adds id-token/security-events write). A reusable requesting
more than its caller grants is a startup_failure — the third
enforcement layer after the lockfile and the caller entries.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -12,6 +12,8 @@ on:
 permissions:
   actions: read
   contents: read
+  id-token: write
+  security-events: write
 
 jobs:
   scorecard: