chore(ci): bump GitHub Actions to Node 24 (#7)

## Summary

Bulk SHA-pin update of GitHub Actions to their latest Node-24-compatible
release. Pre-emptive migration ahead of GitHub Actions runner Node 20
removal in Fall 2026.

## Actions bumped

- `actions/checkout@v4` → `df4cb1c0…` (v6.0.3)
- `actions/setup-go@v5` → `4a360112…` (v6.4.0)

## Verification

Every emitted SHA was verified via `gh api
/repos/<owner>/<repo>/commits/<sha>` before commit.

## Background

Node 20 is being removed from GitHub Actions runners in Fall 2026 (see
[GitHub
changelog](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/)).
This PR pre-emptively bumps every pinned third-party action to its first
Node-24-compatible release so the workflows keep running on the new
runner default.

Author: shanesavoie

.github/workflows/pipeline-common-ci.yaml

@@ -9,9 +9,9 @@ jobs:
     env:
       APP_ENV: qa
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "1.24"