set the permissions required for job in ci-image-scanning.yaml

[zhzhuang-zju]

What type of PR is this?
/kind cleanup

What this PR does / why we need it:
refer to #5048 (comment), set the permissions required for the job in ci-image-scanning.yaml

Which issue(s) this PR fixes:
Parts of #5048

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 28.21%. Comparing base (011db83) to head (9d73721).
Report is 2 commits behind head on master.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5119   +/-   ##
=======================================
  Coverage   28.20%   28.21%           
=======================================
  Files         632      632           
  Lines       43571    43571           
=======================================
+ Hits        12289    12293    +4     
+ Misses      30384    30382    -2     
+ Partials      898      896    -2     

Flag	Coverage Δ
unittests	28.21% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[liangyuanpeng]

I'm a little hesitant about this, it will only distract we, especially since this have only one job.

[zhzhuang-zju]

The change here is actually due to two considerations:

• Avoid top-level permissions inheriting to job-level, making job-level permissions too large. This is because the permissions needed for different jobs can vary greatly. A good practice is: setting as read-only at the top level and the required write permissions are declared at the run-level
• refer to https://scorecard.dev/viewer/?uri=github.com/karmada-io/karmada, it's not recommended that topLevel 'security-events' permission set to 'write'.

[liangyuanpeng]

thanks for explain, it's make sense for me.
/lgtm
/approve

[karmada-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liangyuanpeng

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• .github/workflows/OWNERS [liangyuanpeng]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment