ci(scorecard): pass a read-only PAT for the Branch-Protection check (#168)

Pass a read-only fine-grained PAT (SCORECARD_TOKEN) as repo_token so the OpenSSF Scorecard Branch-Protection check can read classic branch-protection rules instead of failing with an internal error.

.github/workflows/scorecard.yml

@@ -33,6 +33,13 @@ jobs:
         with:
           results_file: results.sarif
           results_format: sarif
+          # The default GITHUB_TOKEN cannot read classic branch-protection
+          # rules, so the Branch-Protection check fails with an internal error
+          # and scores -1. A read-only fine-grained PAT (Administration: read,
+          # Contents: read, Metadata: read) supplied as SCORECARD_TOKEN lets the
+          # check read the protection settings. See
+          # https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
+          repo_token: ${{ secrets.SCORECARD_TOKEN }}
           # Publish to the public OpenSSF endpoint that backs the README badge.
           publish_results: true