CI: Upgrade Github actions, pin to commit SHAs (#3552)

All GitHub Actions in `.github/workflows` and `.github/actions` were
using mutable version tags (`@v4`, `@v5`, etc.), which are not
reproducible and can be silently updated by action authors.

Pins every action to a fixed commit SHA with the version appended as a
comment, and upgrades each to its current latest release:

| Action | Version |
|--------|---------|
| `actions/checkout` | v7.0.1 |
| `actions/setup-python` | v7.0.0 |
| `actions/upload-artifact` | v7.0.1 |
| `actions/download-artifact` | v8.0.1 |
| `actions/cache` | v6.1.0 |
| `codecov/codecov-action` | v7.0.0 |
| `github/codeql-action` | v4.37.3 |
| `EnricoMi/publish-unit-test-result-action` | v2.24.0 |
| `dawidd6/action-download-artifact` | v21 |
| `liskin/gh-problem-matcher-wrap` | v4.0.0 |

`rickstaa/top-issues-action` was already pinned to a SHA.

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>