fix(ci): scope CodeQL's write permission to the job that needs it

Scorecard Token-Permissions (#36) flagged codeql.yml's workflow-level
`security-events: write`: every job in a file inherits the top-level block,
so a write scope declared there is granted far more broadly than the one
step that uploads SARIF needs. Top level is now `contents: read` and the
analyze job elevates `actions: read` + `security-events: write` itself.

All four workflows now follow the same shape — read-only default, write
scoped to the job that earns it:
  ci.yml        top contents:read, no job elevation
  codeql.yml    analyze: actions:read + security-events:write
  scorecard.yml analysis: security-events:write + id-token:write
  snapshot.yml  the two publishing jobs: contents:write