fix(security): pin 14 action refs to SHAs and add a token permissions floor

fix(security): pin 14 action refs to SHAs and add a token permissions floor #419