Fix permissions for scorecard action so it doesnt report itself

Signed-off-by: Nigel Jones <[email protected]>

.github/workflows/scorecard.yml

@@ -1,11 +1,7 @@
 name: Scorecard supply-chain security
 
-permissions:
-  contents: read
-  # needed to allow a badge to be created
-  # ie [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{owner}/{repo}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{owner}/{repo})
-  id-token: write
-  security-events: write
+permissions: read-all
+
 on:
   # For Branch-Protection check. Only the default branch is supported. See
   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection