fix(workflows): validate requires keys and reject phantom permissions gate

fix(workflows): validate requires keys and reject phantom permissions gate #4460