ci: add security-events permission to security workflows

[27Bslash6]

Summary

• Add security-events: write permission to security-fast.yml for rustsec/audit-check SARIF upload
• Add security-events: write permission to security-medium.yml for consistency

Why

The rustsec/audit-check@v2 action requires security-events: write to upload SARIF results to GitHub's Security tab. Without it, the scan runs but findings aren't visible in the UI.

Test plan

• Verify security-fast workflow completes successfully
• Verify SARIF results appear in Security tab after scan