fix(ci): correct reusable-workflow caller permissions and inputs

[hyperpolymath]

Two proven fatal classes, both confirmed by GitHub's own error text:

1. permissions: nested under with: — it is read as a workflow input, and undeclared inputs are rejected at creation (Invalid input, toolchain is not defined in the referenced workflow — januskey run 34410358241). The block is moved to job level, and the undeclared toolchain input is dropped (rust-ci-reusable declares runs-on/enable_audit/enable_coverage/coverage_floor/clippy_args/test_args/check_args/working_directory).
2. Caller granting fewer permissions than the callee declares — Error calling workflow … requesting '<perm>', but is only allowed '<none>'. The job now grants the canonical actions: read, contents: read, security-events: write.

Verified with git apply --check against current main before opening.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a8ea916f-f8c1-44a9-9c88-1bf7175c7466

📥 Commits

Reviewing files that changed from the base of the PR and between 86d93db and 633e8a0.

📒 Files selected for processing (1)

• .github/workflows/scorecard.yml

 ________________________________________________
< If this were a race, you'd still be importing. >
 ------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}