fix(security): pin 25 action refs to SHAs and add a token permissions floor

fix(security): pin 25 action refs to SHAs and add a token permissions floor #191