chore: migrate JavaScript actions to Node 24

[freben]

Summary

• migrate the six remaining JavaScript actions from the Node 20 runtime to Node 24
• retain Node 20 as a comparison leg while adding Node 24 to CI
• update CI to immutable Node 24-capable checkout and setup-node v7 revisions
• restrict CI permissions to read-only contents and disable persisted checkout credentials

pr-automation already targets Node 24 after #187. yarn-install is a composite action and is intentionally unchanged.

Consumer impact

The intended consumers are backstage/backstage and backstage/community-plugins, both on GitHub-hosted runners. Current active usage covers changeset-feedback, cron, pr-automation, and pr-sync; migrating the remaining dormant JavaScript manifests keeps the next release internally consistent.

This PR intentionally leaves dependency modernization and composite-action changes for separate follow-ups. The existing Octokit stack emits Node's DEP0040 warning for its transitive punycode dependency under Node 24, but the warning is non-fatal and the full suite passes.

This supersedes the runtime-manifest scope proposed in #166 and the pr-sync runtime scope in #186.

Validation

• Node 20.20.2: 23 suites, 121 tests passed
• Node 24.16.0: 23 suites, 121 tests passed
• all eight action manifests and the CI workflow parse as YAML
• all JavaScript action manifests resolve to node24; yarn-install remains composite

[carlerikjohan]

Nice that you can run different variations 😄 LGTM!