ci: bump GitHub Actions to Node 24-compatible versions (Node 20 deprecation warnings)

[timimsms]

Context

Recent workflow runs (e.g. the Deploy Documentation run for PR #41 and the v0.1.0 release run) emit annotations like:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4 ...

Everything currently works (GitHub force-runs them on Node 24), so this is not urgent — but the warnings will eventually become failures when GitHub drops the compatibility shim. Deliberately deferred; batch into the next CI-touching change rather than a dedicated PR.

Inventory of pinned actions (as of d1fe415)

Action	Current	Where	Bump
actions/checkout	v4	ci.yml ×5, deploy-docs.yml, release.yml	v5+
actions/setup-go	v5	ci.yml ×4, release.yml	v6+
actions/setup-python	v5	ci.yml, deploy-docs.yml	v6+
actions/upload-pages-artifact	v3	deploy-docs.yml	latest (pulls in upload-artifact@v4, a warning source)
actions/deploy-pages	v4	deploy-docs.yml	latest
codecov/codecov-action	v4	ci.yml	v5+
golangci/golangci-lint-action	v6	ci.yml	latest
goreleaser/goreleaser-action	v6	release.yml	latest
github/codeql-action/upload-sarif	v3	ci.yml	latest
securego/gosec	v2.28.0	ci.yml	pinned by design (#22 rationale) — bump the pin alongside

Suggested approach

• One PR bumping all majors at once; verify each action's changelog for breaking input changes (checkout v5 and setup-go v6 have had default-behavior changes historically).
• Validate on the PR's own CI run (all workflows except release.yml exercise on PR; smoke-test release.yml via a snapshot run or wait for the next tag).
• Consider adding Dependabot for github-actions ecosystem updates so this class of drift is automated going forward.