hotfix: scorecard permissions

Signed-off-by: Sam Gammon <[email protected]>

Author: sgammon

.github/workflows/on.push.yml

@@ -90,6 +90,7 @@ jobs:
       contents: "read"
       checks: "read"
       models: "read"
+      artifact-metadata: "read"
       deployments: "read"
       discussions: "read"
       id-token: "write"