Add trailing comments to job-level write permissions in GitHub workflow files

.github/workflows/benchmark.yml

@@ -46,8 +46,8 @@ jobs:
   store_benchmark:
     needs: benchmark
     permissions:
-      contents: write
-      deployments: write
+      contents: write # required for storing benchmark results
+      deployments: write # required for deployment operations
     strategy:
       matrix:
         components: ["api", "sdk", "exporters"]

.github/workflows/ossf-scorecard.yml

@@ -14,10 +14,8 @@ jobs:
   analysis:
     runs-on: ubuntu-latest
     permissions:
-      # Needed for Code scanning upload
-      security-events: write
-      # Needed for GitHub OIDC token if publish_results is true
-      id-token: write
+      security-events: write # required for code scanning upload
+      id-token: write # required for GitHub OIDC token
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2

.github/workflows/project_management_comment.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.event.label.name == 'help wanted'
     runs-on: ubuntu-latest
     permissions:
-      issues: write
+      issues: write # required for adding comments to issues
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2

.github/workflows/project_management_issue_open.yml

@@ -11,7 +11,7 @@ jobs:
   label_issues:
     runs-on: ubuntu-latest
     permissions:
-      issues: write
+      issues: write # required for adding labels to issues
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2