Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(ci): grant security-fix job permissions in on-main workflow

The top-level 'permissions: contents: read' in on-main.yml was capping the permissions requested by the reusable _security-fix-agent.yml workflow, causing the workflow file to be rejected as invalid on merges to main:

  The nested job 'remediate' is requesting
  'contents: write, issues: write, pull-requests: write, id-token: write',
  but is only allowed 'contents: read, issues: none, pull-requests: none, id-token: none'.

Grant the elevated permissions explicitly on the 'security-fix' job so the called workflow can run, while keeping the restrictive defaults for every other job.