ci: scope the dependabot auto-merge write token to its job

The workflow granted contents: write and pull-requests: write at the top
level, so every step in the run held them, including the checkout and
the dependency install that execute code from the pull request being
merged. Scorecard flags the shape, and the shape is the problem: a
compromised transitive in a Dependabot branch would run with a token
that can write to the repository.

The workflow default is contents: read now, and the two write scopes sit
on the auto-merge job, which is the only job there is and the only place
they are spent. gh pr merge --auto needs contents: write to enable
merge-on-green and pull-requests: write to act on the pull request; the
major-bump comment needs pull-requests: write. The metadata fetch and
the test run need neither. Nothing about which updates merge
automatically changes.

.github/workflows/dependabot-auto-merge.yml

@@ -2,14 +2,20 @@ name: Auto-merge Dependabot
 
 on: pull_request
 
+# Nothing outside the one job needs more than a checkout, so the default for
+# the workflow is read-only and the write scopes sit on the job that spends
+# them: `gh pr merge --auto` writes to the repository's merge queue state, and
+# both the merge and the review comment write to the pull request.
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
     if: github.actor == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1