ci: pin GitHub Actions to latest releases and Node 24 LTS

Pin floating majors (checkout@v7 → v7.0.1, etc.), bump remaining
third-party actions, and keep CI/runtime Node on 24 Active LTS.

Author: thedavidweng

.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4.37.7

.github/workflows/release-please.yml

@@ -13,7 +13,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}