fix: add id-token: write permission to scorecard reusable workflow (#1)

The Sigstore/Fulcio signing step requires a GitHub OIDC token to sign
scorecard results for publication. Reusable workflows have their own
permissions scope — the caller's id-token: write grant doesn't flow
through unless declared here.

Without this, the token expires immediately causing:
  error signing scorecard results: expired_token

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: Fieldnote-Echo

.github/workflows/scorecard.yml

@@ -14,6 +14,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
+      id-token: write
     steps:
       - name: Harden runner
         uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b  # v2.15.0