[SECURITY] Security Update + Dependency Bump (#2584)

* Bump Dependencies
* Fix a Stored XSS: GHSA-8hf7-h89p-3pqj
* Remove all  | safe in templates and HTML from Python
* Add permissions to Github Actions

.github/SECURITY.md

@@ -4,12 +4,13 @@ Keeping MobSF updated to the latest version is essential for ensuring security a
 
 ## Reporting a Vulnerability
 
-Please report all security issues [here](https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/new) or email ajin25(gmail). We believe in coordinated and responsible disclosure.
+Please report all security issues [here](https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/new). We believe in coordinated and responsible disclosure.
 
 ## Past Security Issues
 
 | Vulnerability | Affected Versions |
 | ------- | ------------------ |
+| [Stored XSS via Manifest Analysis - Dialer Code Host Field](https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj) | `<=4.4.4` |
 | [Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction](https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9gh8-9r95-3fc3) | `<=4.4.0` |
 | [Path Traversal in GET /download/`<filename>` using absolute filenames in MobSF data directory)](https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-ccc3-fvfx-mw3v) | `<=4.4.0` |
 | [Zip bomb Denial of Service (DoS) via Resource Exhaustion (Disk Space)](https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-c5vg-26p8-q8cr) | `<=4.3.2` |

.github/workflows/auto-comment.yml

@@ -2,6 +2,10 @@ name: Auto Comment
 
 on: [issues, pull_request]
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   run:
     runs-on: ubuntu-latest

.github/workflows/codeql-analysis.yml

@@ -19,6 +19,9 @@ jobs:
       # required to fetch internal or private CodeQL packs
       packages: read
 
+      # required for commenting on pull requests
+      pull-requests: write
+
       # only required for workflows in private repositories
       actions: read
       contents: read

.github/workflows/docker-latest.yml

@@ -5,6 +5,9 @@ on:
         branches:
             - master
 
+permissions:
+  contents: read
+
 jobs:
     buildx:
         runs-on: ubuntu-latest

.github/workflows/docker-release.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
     buildx:
         runs-on: ubuntu-latest

.github/workflows/docker-test.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
     buildx:
         runs-on: ubuntu-latest

.github/workflows/mobsf-test.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 env:
   MOBSF_DISABLE_AUTHENTICATION: "1"
 

.github/workflows/python-publish.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   deploy: