fix(ci): grant actions: read to the Scorecard caller job

The job-level `permissions:` block REPLACES the workflow-level block, so the
reusable workflow's own `actions: read` cannot elevate the caller's token.
Without it the caller's effective `actions` permission is `none`, and Scorecard's
Packaging check (Actions.ListWorkflowRunsByFileName) can error.

Caught by CodeRabbit on palimpsest-license#151; verified against the whole family:
11 of 13 scorecard.yml callers omit it, including aerie which is already on main.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -14,6 +14,7 @@ jobs:
   analysis:
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write