🐛 Add scorecard-action to the security-events allowlist in Token Permissions check

[spencerschrock]

What kind of change does this PR introduce?

Using scorecard-action no longer decreases a project's score.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Repositories that use ossf/scorecard-action lose 1 point due to the Token Permissions check, because ossf/scorecard-action requires security-events: write.

What is the new behavior (if this is a feature change)?**

This PR adds ossf/scorecard-action to the allowed list of actions that can use security-events: write without affecting scoring.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #2152

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

NONE

[codecov]

Codecov Report

Merging #2153 (b02c20d) into main (2fd81c0) will increase coverage by 0.16%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main    #2153      +/-   ##
==========================================
+ Coverage   42.42%   42.59%   +0.16%     
==========================================
  Files          94       94              
  Lines        7846     7815      -31     
==========================================
  Hits         3329     3329              
+ Misses       4259     4228      -31     
  Partials      258      258              

[azeemshaikh38]

Thanks!

[github-actions]

Integration tests success for
[b02c20d]
(https://github.com/ossf/scorecard/actions/runs/2870973477)