Improve OpenSSF scorecard report score

### Problem

The current OpenSSF Scorecard score is 5.6.
https://scorecard.dev/viewer/?uri=github.com%2Fjupyter%2Fnotebook

### Proposed Solution

Mirroring the improvements that lifted `docker-stacks` from 6.2 to 8.2 (https://github.com/jupyter/docker-stacks/issues/2428):

- [ ] **Token-Permissions (0/10)** — add explicit `permissions:` blocks to workflows in `.github/workflows/`
- [ ] **Branch-Protection (3/10)** — maintainer to enable PR-required reviews, required status checks, and dismiss-stale-reviews on `main`
- [ ] **Code-Review (3/10)** — 6/19 recent PRs were merged without approval; resolved by the branch protection above
- [ ] **CII-Best-Practices (0/10)** — apply for the badge at https://www.bestpractices.dev/ (maintainer)

Realistic target: ~7.5+. Skipping Fuzzing / Signed-Releases / Packaging

Review the workflows in `.github/workflows/` and compare the proposed improvements with the linked docker-stacks issue. Check which scorecard findings can be addressed in repository files versus which require maintainer settings or a CII-Best-Practices application. Done means the applicable scorecard checks improve toward the stated 7.5+ target, while the listed exclusions remain out of scope.

Written by the indexing model from the issue text.