[Backport next] fix experimental and add write permissions for workflows and pin workflow Versions

[T0biii]

backport #422 to next

[grische]

@T0biii let's keep the old commit, so we don't need to look up #422 every time we look into the commit history