Summary

Clean up GitHub Actions workflow permissions to comply with OpenSSF Scorecard Token-Permissions requirements.

Changes Required

High Priority

• Remove unused pull-requests: write from security-scan.yml

Medium Priority

• Scope id-token: write to publish job only in extension-publish.yml
• Scope id-token: write to publish job only in extension-publish-prerelease.yml

Low Priority

• Remove duplicate top-level permissions from 11 workflows
• Add explicit job-level permissions to extension-package.yml

Success Criteria

• All workflows pass CI validation
• Write permissions scoped to job-level only
• Improved OpenSSF Scorecard Token-Permissions check