fix(security): pin GitHub Actions and add token permissions

fix(security): pin GitHub Actions and add token permissions #41