fix(ci): grant pull-requests write for PR comments and fix reviewdog install

PR comment steps need pull-requests: write in addition to issues: write.
Use reviewdog install.sh in psscriptanalyzer workflow to match reviewdog.yml.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: F

.github/workflows/dependency-validation.yml

@@ -13,6 +13,7 @@ env:
 permissions:
   contents: read
   issues: write
+  pull-requests: write
 
 jobs:
   validate-dependencies:

.github/workflows/dependency-vulnerability-scan.yml

@@ -20,6 +20,7 @@ jobs:
     permissions:
       contents: read
       issues: write
+      pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6

.github/workflows/metrics-collection.yml

@@ -31,6 +31,7 @@ jobs:
     permissions:
       contents: read
       issues: write
+      pull-requests: write
 
     steps:
       - name: Checkout repository

.github/workflows/psscriptanalyzer.yml

@@ -59,18 +59,10 @@ jobs:
         shell: pwsh
         run: |
           pwsh -NoProfile -ExecutionPolicy Bypass -File ./.github/scripts/psa_to_reviewdog.ps1 -ReportPath psscriptanalyzer-report.json
-      - name: Run reviewdog (download binary)
+      - name: Install reviewdog CLI
         if: github.event_name == 'pull_request'
         run: |
-          set -e
-          echo "Downloading reviewdog"
-          RD_VER=0.13.1
-          OS_NAME=$(uname | tr '[:upper:]' '[:lower:]')
-          curl -sSL "https://github.com/reviewdog/reviewdog/releases/download/v${RD_VER}/reviewdog_${RD_VER}_${OS_NAME}_amd64.tar.gz" -o /tmp/reviewdog.tar.gz
-          mkdir -p /tmp/reviewdog
-          tar -xzf /tmp/reviewdog.tar.gz -C /tmp/reviewdog
-          sudo mv /tmp/reviewdog/reviewdog /usr/local/bin/reviewdog
-          reviewdog -version
+          curl -sSfL https://raw.githubusercontent.com/reviewdog/reviewdog/master/install.sh | sh -s -- -b /usr/local/bin v0.17.0
       - name: Run reviewdog annotations (rdjson)
         if: github.event_name == 'pull_request'
         run: |

.github/workflows/validate-profile.yml

@@ -15,6 +15,7 @@ jobs:
     permissions:
       contents: read
       issues: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6