Add security-events: write to main workflows, granular permissions

[evankanderson]

Summary

#6406 adjusted security.yml to grant security-events: write, but missed adding these to main.yml for post-merge CI runs. It also granted the access over-broadly, so reduce the permissions scopes in the CI as well.

Testing

Adjusting the PR workflow to follow the same pattern allows checking that the settings in main.yml are likely to work.

[coveralls]

Coverage is 60.356% — evankanderson:fix-ci into mindersec:main. No base build found for mindersec:main.

[evankanderson]

(I think Ozz may be out, and this is actually breaking the post-submit workflow)