`diffProtection` does not work when stack contains tokens

The line: https://github.com/cdklabs/cdk-pipelines-github/blob/main/src/pipeline.ts#L300 does not seem to work when the stack contains tokens.

For example. I create the GitHub OIDC role in an app in my root CDK template, and pass this in to my `GitHubWorkflow.gitHubActionRoleArn` variable. When running the `cdk synth` in GHA, I get an error:

```
Please commit the updated workflow file
```

Which is caused because the workflow appears different because the tokens have changed:

```
- role-to-assume: ${Token[TOKEN.227]}
+ role-to-assume: ${Token[TOKEN.234]}
```

This happens even though the template generates properly in the actual workflow file.

Is there a way to fix this? (Apart from setting `"cdk-pipelines-github:diffProtection": false` in my `cdk.json`)