ci: update GitHub Actions to latest versions (#38278)

* ci: update GitHub Actions to latest versions

Bump all workflow actions to their latest releases, including major
updates for checkout (v7), upload-artifact (v7), github-script (v9),
action-download-artifact (v21), and thollander comment action (v3).

* ci: pin third-party actions to commit SHAs

Keep official GitHub actions on version tags, but pin community
actions to immutable commit hashes for supply-chain safety.

.github/workflows/diff_report.yaml

@@ -17,7 +17,7 @@ jobs:
     - name: Wait for process replay
       id: wait
       continue-on-error: true
-      uses: lewagon/wait-on-check-action@v1.3.4
+      uses: lewagon/wait-on-check-action@1d57e2c51a58d812d2765e036a028b6bdb5a6154
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         check-name: process replay
@@ -26,7 +26,7 @@ jobs:
         wait-interval: 20
     - name: Download diff
       if: steps.wait.outcome == 'success'
-      uses: dawidd6/action-download-artifact@v6
+      uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         workflow: tests.yaml
@@ -37,9 +37,9 @@ jobs:
         allow_forks: true
     - name: Comment on PR
       if: steps.wait.outcome == 'success'
-      uses: thollander/actions-comment-pull-request@v2
+      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
       with:
-        filePath: diff_report.txt
-        comment_tag: diff_report
-        pr_number: ${{ github.event.number }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        file-path: diff_report.txt
+        comment-tag: diff_report
+        pr-number: ${{ github.event.number }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}