ci: move every pinned action to a Node 24 release

[JeanExtreme002]

Why

Recent runs warn that actions/checkout, actions/setup-node and nick-fields/retry target the deprecated Node 20 runtime and are being forced onto Node 24. This moves every pinned action to its newest release, all of which run on Node 24 natively, so the warnings go away before GitHub turns them into failures.

What

Action	From	To
actions/checkout	v4	v7.0.1
actions/setup-node	v4	v7.1.0
actions/setup-python	v5	v7.0.0
actions/setup-go	v6	v7.0.0
actions/cache	v4	v6.1.0
actions/github-script	v7	v9.0.0
actions/deploy-pages	v5.0.0	v5.0.1
amannn/action-semantic-pull-request	v5	v6.1.1
nick-fields/retry	v3	v4.0.0

actions/upload-pages-artifact and pypa/gh-action-pypi-publish were already on their latest release. All SHAs resolved from the release tags via the GitHub API and pinned with the full version in the comment.

Breaking changes checked

• setup-node v7 removed the dummy NODE_AUTH_TOKEN fallback. The publish job authenticates via OIDC trusted publishing and never set a token, so nothing changes there. Following the setup-node trusted publishing docs, the publish step now sets package-manager-cache: false.
• github-script v9 no longer supports require('@actions/github') inside scripts. Neither the labeler nor the branch-cleanup script does that; both use the injected github, context and core.
• checkout v7 blocks checking out fork PRs under pull_request_target. The two pull_request_target workflows here do not check out code.
• setup-python v7 removed the pip-install input, which is not used.
• setup-go v7, cache v6, retry v4, semantic-pull-request v6: ESM and Node 24 migrations only, no input changes.

Verification

• Every workflow still parses as YAML.
• The PR's own checks exercise checkout, setup-node, setup-python, setup-go, retry, github-script (labeler) and semantic-pull-request (title lint).
• The publish workflow was exercised with a workflow_dispatch dry run from this branch (see the comment below): PyPI side green end to end, npm side green up to npm publish --dry-run, which the registry refuses because 1.6.3 is already published. That limitation predates this PR.
• deploy-docs (cache v6, deploy-pages v5.0.1) only runs on push to main; it will run on merge since its own file is in the path filter.

[JeanExtreme002]

Publish dry run from this branch: https://github.com/JeanExtreme002/FlightRadarAPI/actions/runs/37978908688

• verify-versions and publish-pypi (checkout v7, setup-python v7) passed end to end, including the wheel import check.
• publish-npm (checkout v7, setup-node v7 with registry-url and no token) got through npm ci, lint, type check and offline tests, then npm publish --dry-run failed with You cannot publish over the previously published versions: 1.6.3. That is the registry refusing a version that already exists, not the action: the last green dry run (32805560593) ran before 1.6.1 was on npm. Every dry run on an already-released version fails this way, so the step is only meaningful on a bump branch before its release.
• setup-node's own v7 notes confirm the NODE_AUTH_TOKEN change does not affect npm Trusted Publishing (OIDC).
• No Node.js 20 is deprecated warning on any run that used this branch's workflow files. The labeler and title-lint runs still show one because pull_request_target executes the workflow from main; they pick up the new SHAs after merge.