Improves repo security

[Adam-it]

🎯 Aim

The aim of this PR is to improve repo security by:

• Adds a missing SECURITY policy file that explains how repo/product vulnerabilities should be reported in private rather than in public
• Adds dependabot 7 days cooldown to prevent rapid supply chain attacks
• Adds timeouts to all workflows
• Updates the build and test workflow to run tests from PR branch - till now it checked tests that were on dev branch for every PR
• Adds minimal GH token permissions to each workflow
• GH actions pinned by SHA tag to commit not by version tag

[gautamdsheth]

@Adam-it - LGTM , merge it at your convenience. Just wondering how we can handle updates to these ? Does dependabot handle it ?

[Adam-it]

@Adam-it - LGTM , merge it at your convenience. Just wondering how we can handle updates to these ? Does dependabot handle it ?

Yes, dependabot will update the SHA of te commit of the next v release of GH actions