fix(ci): give callers the union of the reusable's declared permissions

[hyperpolymath]

Job-level permissions: replace the workflow-level block, so a job block that lists only some keys silently drops the rest and GitHub refuses the call (The workflow is requesting 'id-token: write'/'contents: read', but is only allowed '<none>').

This sets each calling job's block to the union of the workflow-level grants and the callee's declared permissions (max level per key), validated by re-parsing the file before commit.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3ec62dd2-7eb1-4858-9e61-8392ac91a8bf

📥 Commits

Reviewing files that changed from the base of the PR and between d20da11 and fb213fe.

📒 Files selected for processing (1)

• .github/workflows/scorecard.yml

 ____________________________________________
< Let's git serious about your code quality. >
 --------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud