Add security policy, GITHUB_TOKEN access restrictions.

[ssheorey]

permissions:
  contents: write   # to upload artifacts and update github release packages
  actions: write     # to allow cancelling concurrent CI runs (concurrency key)

[update-docs]

Thanks for submitting this pull request! The maintainers of this repository would appreciate if you could update the CHANGELOG.md based on your changes.

[michaelbeale-IL]

Do you need this here? This gives every step content write access. Could it be limited to just the steps that need it?

[ssheorey]

Permissions don't seem to work per step, only per job (tried per step and github refused to run it). That workflow only has one job.