Actions Workflow Diff

Compare two GitHub Actions workflow files and report what the change grants or removes. Permission scopes are ranked none, read and write, so a widening is reported and a narrowing is noted: only one of them grants something new. Also reports a privileged trigger added, a trigger removed, a permissions block removed so a default set elsewhere applies, an action moved from a commit to a mutable tag, an action version change, and a job removed so whatever it checked no longer runs.