fix: add permissions for job 'ossf-scorecard' in called workflow

[Wuodan]

This adds the permisisons needed for the test to run.

Reason:

Currently the test workflow fails instantly with:

 Invalid workflow file: .github/workflows/test.yml#L8
The workflow is not valid. .github/workflows/test.yml (Line: 8, Col: 3): Error calling workflow 'bats-core/.github/.github/workflows/test.yml@v1'. The nested job 'ossf-scorecard' is requesting 'security-events: write, id-token: write', but is only allowed 'security-events: none, id-token: none'.

The current bats-core/.github/.github/workflows/test.yml@v1 runs tag v1.1.0 in bats-core/.github where the job ossf-scorecard needs extra permissions, see bats-core/.github/.github/workflows/test.yml:56

[martin-schulze-vireso]

Thanks for your fix. I wonder why we did not catch this in the PR that introduced this change.