ops: bump GitHub Actions pins to Node 24 runtimes

[ericfitz]

Every action pinned in the four workflows ran on the deprecated node20
runtime and was being force-run on Node 24 by the runner. That warning
preceded the bump job in Version Bump hanging: all of its steps
reported success but the check-run never finalized, leaving PR #848
stuck at UNSTABLE with a phantom in_progress check.

• actions/checkout v4 -> v7
• actions/setup-node v4 -> v7
• actions/create-github-app-token v1 -> v3
• actions/cache v4 -> v6
• actions/upload-artifact v4 -> v7
• pnpm/action-setup v4 -> v6
• github/codeql-action/{init,analyze} v3 -> v4

Compatibility checked against the breaking changes in each major:

• create-github-app-token v2 removed the snake_case inputs and made
  app-id/private-key required; all three call sites already use the
  hyphenated required form. v3 needs NODE_USE_ENV_PROXY only for proxy
  setups, which we do not use.
• setup-node v5 auto-caches when package.json has a packageManager
  field, which would have broken the jobs that set up Node before pnpm.
  v6 narrowed that to npm only, and this repo declares pnpm, so landing
  directly on v7 skips the hazard entirely.
• checkout v7 blocks fork checkouts for pull_request_target and
  workflow_run; no workflow here uses either trigger. v6 moved persisted
  credentials to a separate file, but persist-credentials still defaults
  true, so the Version Bump push keeps working, and deps-bump already
  sets it false and pushes with the App token explicitly.
• pnpm/action-setup reads the version from packageManager (pnpm 10.34.4)
  at every call site; v6 only adds pnpm 11 support.
• codeql-action v4 forked from 3.x at 4.30.7 solely for the Node 24
  runtime. The only removed input, add-snippets, is not used here, and
  the local config-file path form is still accepted.

Verified with actionlint (clean apart from a pre-existing SC2086 info at
codeql.yml:43) and pnpm run lint:all.