Bump and pin GitHub actions versions (#7879)

* chore: bump GitHub Actions to latest major versions

- actions/checkout v6 → v7 (across all workflows)
- azure/setup-helm v4 → v5

* chore: bump actions/checkout and actions/setup-node in terriamap workflows

- actions/checkout v2 → v7
- actions/setup-node v1 → v6

* chore: pin GitHub Actions to exact commit SHAs

All root workflow actions pinned to immutable SHAs with version comments.
Skipped: 8398a7/action-slack (pending replacement with slackapi/slack-github-action).

* chore: replace GabrielBB/xvfb-action with xvfb-run --auto-servernum

Removes dependency on unmaintained third-party action. xvfb-run is
pre-installed on ubuntu-latest runners and provides equivalent behaviour.

Author: zoran995

.github/workflows/ci.yml

@@ -14,9 +14,9 @@ jobs:
         node-version: [22.x, 24.x, 26.x]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
       - run: rm -rf node_modules && yarn install --frozen-lockfile

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1