Authorize synchronization of the Ruff security mirror (#28685)
The security-mirror sync is denied by STS because `ruff-security` has no
policy granting access to `sync-ruff-security.yml`. Add a rule bound to
Ruff's `main` branch, the `automations` environment, and the sync
workflow, with `contents: write` and `workflows: write` limited to the
pinned `ruff-security` repository ID. After this lands,
`ruff-security/main` needs a one-time fast-forward to receive the policy
before automated sync can authorize itself.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
