[policy] Gate security scans on repository visibility

Change-Id: I998948b9c6aeba98016ad15215e639940cc45d17

Author: heimanba

.github/workflows/codeql.yml

@@ -1,6 +1,7 @@
 name: CodeQL
 
 on:
+  workflow_dispatch:
   push:
     branches: [main]
   pull_request:
@@ -14,8 +15,10 @@ permissions:
 jobs:
   analyze:
     name: Analyze TypeScript
+    if: github.event.repository.private == false
     runs-on: ubuntu-latest
     permissions:
+      actions: read
       contents: read
       security-events: write
       packages: read

.github/workflows/scorecard.yml

@@ -1,6 +1,7 @@
 name: OpenSSF Scorecard
 
 on:
+  workflow_dispatch:
   branch_protection_rule:
   push:
     branches: [main]
@@ -12,6 +13,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Supply-chain analysis
+    if: github.event.repository.private == false
     runs-on: ubuntu-latest
     permissions:
       actions: read