Security hardening (microsoft#1383)

- Move security-events to job-level in PSSriptAnalyzer workflow
- Add Harden Runner to RemoveRepositories job

Author: mazhelez

.github/workflows/CleanupTempRepos.yaml

@@ -60,6 +60,11 @@ jobs:
     runs-on: [ ubuntu-latest ]
     needs: [ Check ]
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Remove Temp Repositories

.github/workflows/powershell.yaml

@@ -12,12 +12,13 @@ on:
 
 permissions:
   contents: read
-  security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
 
 jobs:
   build:
     name: PSScriptAnalyzer
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2