chore: tighten GITHUB_TOKEN permissions for Scorecard

[atkrad]

What problem would this solve?

After landing OSV-Scanner CI (#60), OpenSSF Scorecard opened a handful of Token-Permissions alerts on Code Scanning. The OSV workflows declare security-events: write at the workflow top level, and the release job still asks for packages: write even though we only push to Docker Hub.

Scorecard wants top-level tokens read-only, with any write scopes scoped to the job that needs them. Leaving those alerts open is noise, and the unused packages: write is just extra blast radius we do not need.

What do you want?

1. Move security-events: write (and actions: read) from the top level of the OSV PR/scheduled workflows down to the calling job. Keep top-level as contents: read.
2. Drop packages: write from the release job. Keep contents: write for action-gh-release, plus discussions: write and id-token: write.
3. Confirm the next Scorecard run clears the related Token-Permissions alerts (or leave contents: write as an accepted warning if it still shows).

Alternatives considered

• Dismiss the alerts as false positives without changing YAML: fine for contents: write on release, not for top-level security-events: write or unused packages: write.
• Broader Scorecard cleanup (Code-Review, Branch-Protection, Fuzzing) in the same PR: those are settings/process work, better as follow-ups.

Notes

Tracked on Code Scanning under Scorecard Token-Permissions (alerts that pointed at the OSV workflows and release.yml). Implementation: #64.