tighten GITHUB_TOKEN workflow permissions

[atkrad]

Summary

• Move OSV-Scanner security-events: write from workflow top-level to the calling job so Scorecard Token-Permissions stops flagging write scopes at the top level.
• Drop unused packages: write from the release job (images go to Docker Hub, not GHCR).

Related

Fixes #65

Test plan

• Confirm OSV-Scanner PR/scheduled workflows still upload SARIF
• nix run .#lint / pre-commit clean
• Confirm Scorecard re-run clears the Token-Permissions alerts on the OSV workflows and unused packages: write
• Spot-check next tag/release job still creates the GitHub Release (needs contents: write)

Labels

• One of: kind/feature, kind/bug, kind/docs, kind/chore
• Add breaking-change if this breaks existing CLI or config behavior
• Add skip-changelog for internal-only PRs that should not appear in notes

Checklist

• Title is short and imperative (matches commit style)
• Docs / CLI help updated when user-facing (README.md, docs/cli/) — N/A
• No secrets or local-only paths in the diff

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!