Improve OpenSSF scorecard report score

[goelakash]

Problem

The current OpenSSF Scorecard score is 5.6.
https://scorecard.dev/viewer/?uri=github.com%2Fjupyter%2Fnotebook

Proposed Solution

Mirroring the improvements that lifted docker-stacks from 6.2 to 8.2 (jupyter/docker-stacks#2428):

• Token-Permissions (0/10) — add explicit permissions: blocks to workflows in .github/workflows/
• Branch-Protection (3/10) — maintainer to enable PR-required reviews, required status checks, and dismiss-stale-reviews on main
• Code-Review (3/10) — 6/19 recent PRs were merged without approval; resolved by the branch protection above
• CII-Best-Practices (0/10) — apply for the badge at https://www.bestpractices.dev/ (maintainer)

Realistic target: ~7.5+. Skipping Fuzzing / Signed-Releases / Packaging

[goelakash]

cc: @jtpio

[goelakash]

imo this is already Triaged