ci: drop contents and actions read from the scorecard job (#97)

Both are private-repository permissions and this repo is public.

The only Actions API call Scorecard makes is ListWorkflowRunsByFileName, from
the Packaging and Binary-Artifacts checks. That endpoint is publicly readable:
requesting it for a public repo with no authentication at all returns 200.

Upstream's starter workflow ships `contents: read` and `actions: read` commented
out under "uncomment if installing in a private repository", and OSSF runs
Scorecard on its own public repos -- ossf/scorecard and ossf/scorecard-action --
with `security-events: write` and `id-token: write` alone. Those runs are green
and score Packaging 10, Binary-Artifacts 10 and CI-Tests 10, which is the same
evidence for dropping `contents: read`: their checkout step works without it.

Follows #94, which merged before this was raised in review on qBraid/pyqasm#412.

Author: ryanhill1

.github/workflows/scorecard.yml

@@ -27,11 +27,9 @@ jobs:
     permissions:
       security-events: write   # upload SARIF to code scanning
       id-token: write          # publish results to the public Scorecard API
-      contents: read
-      # Lets Scorecard read workflow definitions and run history. Documented by the
-      # upstream starter workflow as required for private repositories; this repo is
-      # public, so it is retained only as a safeguard should that ever change.
-      actions: read
+      # `contents: read` and `actions: read` are deliberately absent. Upstream ships both
+      # commented out, needed only for private repositories, and OSSF runs Scorecard on its
+      # own public repos with exactly the two permissions above.
 
     # Actions are pinned to full commit SHAs: a tag is mutable and can be repointed at
     # other code, which is what Scorecard's own Pinned-Dependencies check looks for.