bugfix: special-case workflow_call in excessive-permissions

[woodruffw]

This tweaks the excessive-permissions audit in the following ways:

1. When a workflow is purely a reusable workflow (i.e. has workflow_call and no other triggers), we emit pedantic findings instead of regular ones. In effect, we assume that the caller workflow sets the right permissions when calling the reusable workflow.
2. We now check permissions: for reusable job calls, and emit a regular finding if a reusable call does not explicitly set permissions. This effectively covers (1) by checking the caller workflow.

If I'm thinking about this correctly, this combination should strike a reasonable balance between signal and noise: reusable workflow callers should always be setting permissions explicitly, and reusable workflows themselves shouldn't be flagged unless other conditions are satisfied (e.g. there are other triggers besides workflow_call).

Fixes #472.