ci: fix secscan permissions for CodeQL upload-sarif

The CodeQL upload-sarif action failed with "Resource not accessible by
integration" because the workflow had no explicit permissions block, so
the GITHUB_TOKEN lacked security-events access. Add a top-level
permissions block granting contents:read and security-events:write, and
set continue-on-error on the upload step so a fork/PR context can no
longer fail the whole run.

Assisted-by: opencode:glm-5.2 [bash] [edit]

Author: nandanadileep

.github/workflows/secscan.yaml

@@ -7,6 +7,10 @@ on:
   schedule:
   - cron: '0 0 * * 0'
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   tests:
     runs-on: ubuntu-latest
@@ -27,6 +31,7 @@ jobs:
           args: '-no-fail -exclude-dir=backend/go/supertonic -fmt sarif -out results.sarif ./...'
       - name: Upload SARIF file
         if: ${{ github.actor != 'dependabot[bot]' }}
+        continue-on-error: true
         uses: github/codeql-action/upload-sarif@v4
         with:
           # Path to SARIF file relative to the root of the repository