You could use either. The difference is that if you use scores, you will consume the HashMap and you will not be able to use it later. When using &scores, you can use the HashMap later, but the types of key and value will be references.
Some additional context as to why it works this way - for loops are built on top of the IntoIterator trait. Whatever you pass after the in keyword will implicitly have IntoIterator::into_iter called on it. So let's find the relevant implementations for your case!
The type of scores is HashMap, so impl IntoIterator for HashMap is used - this returns an iterator of values, so it must consume the HashMap.
The type of &scores is &Hashmap, so impl IntoIterator for &HashMap is used - this returns an iterator of references, so it doesn't consume the original HashMap.
There's more good info on this behavior in the std::iter docs.