Migrate to reusable workflows

[mbrousset-ledger]

This PR migrates workflows to use centralized reusable workflows from LedgerHQ/ledger-app-workflows.

[ledger-wiz-cspm-secret-detection]

Wiz Scan Summary

Scanner	Findings
Sensitive Data	-
Secrets	-
IaC Misconfigurations	2
SAST Findings	-
Software Management Findings	-
Total	2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

In general, the fix is to explicitly declare permissions for the GITHUB_TOKEN either at the workflow root (applies to all jobs) or at the job level (applies only to that job), and to restrict them to the minimal access needed. For a typical CodeQL analysis workflow that only needs to read the repository contents and security events, GitHub’s own starter workflows use read-only or narrowly scoped permissions such as actions: read, contents: read, and security-events: write.

The single best way to fix this without changing existing functionality is to add a permissions block under the analyse job. This keeps the change local to the job highlighted by CodeQL and avoids affecting any other jobs that might later be added to the workflow. A safe, least‑privilege set matching GitHub’s recommended CodeQL configuration is:

permissions:
  actions: read
  contents: read
  security-events: write

These lines should be indented to align with the other keys under analyse (e.g., name, uses, secrets) in .github/workflows/codeql.yml. No additional methods, imports, or definitions are needed because this is pure workflow configuration.

In general, the fix is to add an explicit permissions block that grants the least privileges necessary for the workflow. For a unit-test workflow that just checks out code and runs tests, contents: read is typically sufficient. Since this job delegates to a reusable workflow, the best non-breaking change is to define a conservative, read-only permission set at the job level; if the reusable workflow needs additional, more specific write scopes, they can be added later based on actual needs.

Concretely, in .github/workflows/unit-tests.yml, under the unit_tests job (around line 14), add a permissions: section aligned with the existing keys (name, uses, secrets). The minimal, safe block is:

permissions:
  contents: read

This limits the GITHUB_TOKEN to read repository contents while leaving the rest unchanged. No imports, methods, or other definitions are needed, as this is a pure YAML configuration change inside the shown file and snippet.

[mbrousset-ledger]

Closing this PR for now.