Give Semgrep permission to write its report (#6253)

Previously semgrep had read-all permission. This patch limits read
slightly and adds write permissions to security-events.

.github/workflows/sec_sast_semgrep_cron.yml

@@ -6,7 +6,10 @@ on:
   schedule:
     - cron: 0 1 * * 6
 
-permissions: read-all
+permissions:
+  actions: read
+  contents: read
+  security-events: write
 
 jobs:
   semgrep-full: