authors can invoke publishBranch, reintegrate and depublishBranch workflow actions

Authors are not allowed to execute publish/depublish or reintegrate workflow actions, but currently they are allowed to execute publishBranch and depublishBranch and reintegrate.

Although authors will never call these actions via the UI (we use publish and depublish hints for the buttons) it is still an security issue. Developers could for instance implement custom workflow actions that would call these workflow actions.