Update scorecard.yml with token

[Zeitsperre]

Pull Request Checklist:

• This PR addresses an already opened issue (for bug fixes / features)
  • This PR fixes #xyz
• Tests for the changes have been added (for bug fixes / features)
  • (If applicable) Documentation has been added / updated (for bug fixes / features)
• CHANGES.rst has been updated (with summary of main changes)
  • Link to issue (:issue:number) and pull request (:pull:number) has been added

What kind of change does this PR introduce?

• Adds a token that allows OpenSSF Scorecard workflow to see the branch protection rules of xclim.

Does this PR introduce a breaking change?

No.

Other information:

The token (OPENSSF_SCORECARD_TOKEN) has been given the following permissions for repositories xclim, xscen, miranda, figanos, and raven-hydro:

• Administration: Read-Only
• Metadata: Read-Only
• Webhooks: Read-Only

This is set to expire on January 1st, 2025. After this point it will need to be renewed or another person with maintainer access can generate a new one.

See: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md

[coveralls]

coverage: 90.284%. remained the same
when pulling 3f4c927 on openssf-token
into 507bd0b on master.