Non-essential warnings from Actions Workflow Security Scan

We have the `scan-pr` (Google GitHub Admin: Actions Workflow Security Scan) workflow configured to check pull-request for the [quantumlib/Cirq](https://github.com/quantumlib/Cirq) repository. However, the workflow produces some warnings which appear to ask for fixups in configuration, please see the example below.

Would it be possible to address these so we avoid non-essential warnings in successful scans?

----

Workflow run: https://github.com/quantumlib/Cirq/actions/runs/21697490339
```
Annotations
2 warnings

scan-pr
Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is 2.23.5.

scan-pr
This run of the CodeQL Action does not have permission to access the CodeQL Action API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the workflow has at least the 'security-events: read' permission. Details: Resource not accessible by integration - https://docs.github.com/rest
```