Fix TokenPermissionsID: add contents: read to job permissions in scorecard.yml

Fixes Scorecard TokenPermissionsID alert by adding explicit contents: read
permission to the analysis job's permissions block. When job-level permissions
are specified, GitHub sets unspecified permissions to 'none' by default.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: mistral-vibe

.github/workflows/scorecard.yml

@@ -13,6 +13,7 @@ permissions: read-all
 jobs:
   analysis:
     permissions:
+      contents: read
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8750b94ac1bbe8c51ad13fe106669b13478f0b62