Reduce scorecard workflow permissions scope

[robert-cronin]

Description of the PR

Fixes #2275

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If GraphQL schema is changed, GraphQL client updates/additions have been made
• If OpenAPI spec is changed, make generate has been run
• If ent schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged

[robert-cronin]

I did try with the id-token: write permission set but it seems that the Scorecard API has some checks to ensure the integrity of the data, including default branch check:

https://github.com/robert-cronin/guac/actions/runs/12076752606/job/33678574053
https://github.com/ossf/scorecard-action?tab=readme-ov-file#workflow-restrictions

[funnelfiasco]

We shouldn't declare write permissions at the workflow level as a matter of practice. Write permissions should be granted on a per-job basis as needed. The practical effect is the same here, since there's only one job, but the tooling will still complain :-)

[robert-cronin]

We shouldn't declare write permissions at the workflow level as a matter of practice. Write permissions should be granted on a per-job basis as needed. The practical effect is the same here, since there's only one job, but the tooling will still complain :-)

Oh, I missed the existing id-token permission set on the job level! Thank you for catching that! I'll take out the permission I added to the workflow level

[funnelfiasco]

LGTM!