fix(ci): grant callers the permissions their reusable workflows declare

[hyperpolymath]

GitHub refuses these runs at workflow-creation time: Error calling workflow ... The workflow is requesting '<perm>', but is only allowed '<none>'. A workflow_call job must grant a superset of the callee's declared permissions. This adds the canonical grant (actions: read, contents: read, security-events: write) that the healthy repos already carry.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 350ccf70-05c8-41d5-9884-b00aa52b1e15

📥 Commits

Reviewing files that changed from the base of the PR and between 4d6dec4 and 5208f68.

📒 Files selected for processing (7)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml
• .github/workflows/release.yml
• .github/workflows/rust-ci.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

 _____________________________________
< ICBM: Intercontinental Bug Missile. >
 -------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}