allow reading actions and content for scorecard analysis

Author: cherriechang

.github/workflows/scorecard.yml

@@ -23,13 +23,14 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
+      actions: read
+      contents: read
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
       # Needed to publish results and get a badge (see publish_results below).
       id-token: write
       # Uncomment the permissions below if installing in a private repository.
-      # contents: read
-      # actions: read
+
 
     steps:
       - name: "Checkout code"