ci(sonarqube): pin the CI reusables to the scan without PR analysis

[BryanFRD]

Follow-up to #340 (refs #329), from its review.

reusable-ci-{rust,node,astro,go} still called reusable-sonarqube-scan at 2883414, the version that analysed pull requests and declared pull-requests: write. That forced them to keep granting pull-requests: write to a job that no longer runs on a pull request, and nothing in the files said why, so the next cleanup would have dropped it and broken every caller at startup.

This moves the four pins to efe7f97 (#340's merge commit), whose scan declares contents: read only, and drops the now-unneeded grant. The constraint the review flagged is gone rather than documented.

[ferrfleet]

Checked the pin target: reusable-sonarqube-scan.yml at efe7f97 declares permissions: contents: read and gates the job on github.event_name != 'pull_request', so dropping pull-requests: write in the four callers cannot fail the call at startup. Every input each caller passes (runner, working-directory, project-key, coverage-artifact, args) and the SONAR_TOKEN secret still exist at that SHA. Two nits inline on leftover packages: read.

[ferrfleet]

Nit: packages: read is surplus here for the same reason pull-requests: write was. The scan at efe7f97 only checks out, downloads artifacts and runs sonar-scanner; nothing reads GitHub Packages, and the callee declares contents: read alone.

Suggested change

	contents: read
	packages: read
	contents: read

[ferrfleet]

Nit: same as in the Astro reusable, packages: read is unused by the scan job (the install happens in test, not in the called workflow).

Suggested change

	contents: read
	packages: read
	contents: read