Close the Scorecard token-permission and unpinned-restore findings

[twcclegg]

Closes the two actionable OpenSSF Scorecard findings (score is 7.3 as of today).

Token-Permissions 0/10 — three warnings, all structural rather than actual over-grant:

• codeql.yml had no top-level permissions: block, so the file defaulted to whatever the repo
  default is. Now pinned to contents: read; the job's own block is unchanged.
• create_new_release_on_new_metadata_update.yml declared contents: write + actions: write at
  file level. Both moved to the job, so a workflow-wide write token is never minted. Same
  effective grant, same comment explaining why the writes are needed.

post_performance_test_comment.yml and deploy-demo.yml also carry top-level writes but were not
flagged — Scorecard only treats contents/actions/packages writes as high severity, and both of
those files have a single job, so moving them would change nothing. Left alone.

Pinned-Dependencies 8/10 — "1 of 3 nugetCommand dependencies pinned". Adds --locked-mode to
the demo and publish restores, matching what the unit-test workflow already does. All eight
projects have a committed packages.lock.json, so this is enforcement, not new policy. It matters
most in publish_nuget.yml, which is the restore whose output ships.

Branch-Protection −1 — the default GITHUB_TOKEN cannot read classic branch-protection rules.
Wires repo_token to a SCORECARD_TOKEN secret, falling back to github.token when the secret is
absent, so this is safe to merge before the PAT exists — the check just stays inconclusive until then.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.01%. Comparing base (10432c2) to head (ee4efd0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #387   +/-   ##
=======================================
  Coverage   98.01%   98.01%           
=======================================
  Files          39       39           
  Lines       52854    52854           
  Branches     1119     1119           
=======================================
  Hits        51803    51803           
  Misses        796      796           
  Partials      255      255           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[wmundev]

looks good, nice one